A Kubernetes cluster is many networked services, several of which grant broad control when they are reachable without proper authentication. Some are exposed by misconfiguration (an anonymous-auth API server, an insecure API port, a read-write kubelet), some by design on the node network (cAdvisor, metrics), and some are credentials left where an attacker finds them (a kubeconfig). etcd is the extreme case: it holds the entire cluster state, including every secret, so reaching it is total compromise.
Probe the common exposed surfaces:
# API server anonymous and insecure port
curl -sk https://<api>:6443/version; curl -s http://<api>:8080/version
# kubelet read-write and read-only ports on a node
curl -sk https://<node>:10250/pods | head; curl -s http://<node>:10255/pods | head
# etcd client port
curl -sk https://<node>:2379/version
# dashboard and metrics
curl -sk https://<node>:30000/ ; curl -s http://<node>:4194/metrics | head
Subtopics#
- Anonymous API access: unauthenticated requests the API server accepts.
- Insecure apiserver port: the legacy unauthenticated API port.
- API server proxy: reaching nodes and services through the API proxy.
- Kubelet API: the node agent's read-write and read-only APIs.
- etcd: the datastore holding all cluster secrets.
- Dashboard: the web UI and its service account.
- cAdvisor and metrics: container stats endpoints leaking environment data.
- Exposed kubeconfig: leaked cluster credentials files.
- Helm Tiller: the legacy cluster-admin Tiller service.