1 min Reading Time<\/p>\n
Kubernetes has become the de facto standard for container orchestration. However, the system’s complexity creates a massive attack surface: misconfigured RBAC policies, exposed API servers, and privileged containers are more the rule than the exception in production environments. Seven errors that can be fixed immediately.<\/strong><\/p>\n Error 1: API server publicly accessible.<\/strong> The Kubernetes API server is the brain of the cluster. Whoever has access controls everything. Nevertheless, scanners like Shodan find hundreds of thousands of publicly accessible API servers. Solution: Make the API server accessible only via VPN or Private Endpoint.<\/p>\n Error 2: Overprivileged RBAC roles.<\/strong> Cluster-admin for every developer because it’s “easier.” The principle of least privilege is often ignored in Kubernetes. Solution: Namespace-specific roles instead of ClusterRoles, regular RBAC audits with tools like rbac-police or kubectl-who-can.<\/p>\n Error 3: Privileged containers.<\/strong> Containers running as root or with the privileged flag set can break out of the host system. A container escape gives the attacker access to the entire node. Solution: SecurityContext with runAsNonRoot, readOnlyRootFilesystem, and dropping all Linux capabilities.<\/p>\n Error 4: No network policies.<\/strong> Without network policies, any pod can communicate with any other pod. Lateral movement within the cluster is trivial. Solution: Default-deny policy for all namespaces, then explicit allow rules for necessary communication.<\/p>\n Error 5: Secrets as Base64 in etcd.<\/strong> Kubernetes secrets are only Base64 encoded, not encrypted. Anyone with access to etcd can read all secrets in plaintext. Solution: Enable encryption at rest for etcd or use external secret management solutions (Vault, AWS Secrets Manager, Azure Key Vault).<\/p>\n Error 6: Outdated container images.<\/strong> Images with known CVEs run in production for months because no one scans them. Solution: Image scanning in the CI\/CD pipeline (Trivy, Snyk Container) and admission controllers (OPA Gatekeeper, Kyverno) that block insecure images.<\/p>\n Error 7: No pod security standards\/admission.<\/strong> Since Kubernetes 1.25, Pod Security Standards (PSS) are the official successor to PodSecurityPolicy. Three levels: Privileged (everything allowed), Baseline (known escalation vectors blocked), Restricted (best practice). Many clusters still run without any restrictions.<\/p>\n Solution: Activate PSS in “warn” mode, identify and fix violations, then switch to “enforce.” For more complex policies: OPA Gatekeeper or Kyverno as admission controllers.<\/p>\n Exposed API Servers:<\/strong> 380,000+ publicly accessible (Shadowserver Foundation)<\/p>\n Security Incidents:<\/strong> 67 percent of K8s users had an incident (Red Hat 2024)<\/p>\n Image Vulnerabilities:<\/strong> On average, 72 known CVEs per container image (Sysdig 2024)<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n Tools: kube-bench (CIS Benchmark Check), kubescape (NSA\/CISA Hardening Guide), Trivy (image + config scanning), rbac-police (RBAC audit). All open source and ready to use in minutes.<\/p>\n<\/details>\n Managed K8s reduces the attack surface of the control plane, but the workload configuration (RBAC, network policies, pod security) remains the user’s responsibility. Most of the mentioned errors affect exactly this area.<\/p>\n<\/details>\n Network policies with default-deny. In most clusters, pod-to-pod communication is completely unrestricted. A single default-deny policy per namespace blocks lateral movement immediately – with minimal effort.<\/p>\n<\/details>\n More from the MBF Media Network<\/p>\nTL;DR<\/h2>\n
\n
1-2: API Server Exposure and Missing RBAC<\/h2>\n
3-4: Privileged Containers and Missing Network Policies<\/h2>\n
5-6: Secrets in Plaintext and Outdated Images<\/h2>\n
7: Missing Pod Security Standards<\/h2>\n
Key Facts<\/h2>\n
Frequently Asked Questions<\/h2>\n
How do I check my cluster for misconfigurations?<\/strong><\/summary>\n
Is a managed Kubernetes (EKS, AKS, GKE) enough?<\/strong><\/summary>\n
What is the quickest win?<\/strong><\/summary>\n
Related Articles<\/h2>\n
\n