https://kubernetes.fail/tags/security/Recent content in Security on Kubernetes FailHugoenMon, 15 Apr 2024 09:15:00 +0200https://kubernetes.fail/posts/rbac-misconfiguration/Mon, 15 Apr 2024 09:15:00 +0200https://kubernetes.fail/posts/rbac-misconfiguration/<h2 id="security-incident">Security Incident</h2> <p>An overly permissive RBAC configuration allowed an attacker to:</p> <ol> <li>Gain access through a compromised developer account</li> <li>Escalate privileges using cluster-admin binding</li> <li>Deploy cryptocurrency mining containers</li> <li>Access sensitive data from other namespaces</li> </ol> <h2 id="how-it-happened">How It Happened</h2> <ul> <li>Default namespace had cluster-admin role binding</li> <li>No network policies between namespaces</li> <li>No pod security policies enforced</li> <li>Developer accounts had excessive permissions</li> </ul> <h2 id="immediate-actions">Immediate Actions</h2> <ol> <li>Revoked all compromised credentials</li> <li>Deleted malicious pods</li> <li>Isolated affected nodes</li> <li>Rotated all cluster certificates</li> </ol> <h2 id="long-term-fixes">Long-term Fixes</h2> <ul> <li>Implemented principle of least privilege</li> <li>Enabled network policies</li> <li>Deployed pod security admission</li> <li>Regular RBAC audits</li> <li>Developer security training</li> </ul>