Прошлый подобный отчет для
Kubernetes датируется 2019 годом и был для версии 1.13.Основные результаты нового отчета:
- A number of concerns with the administrative experience as it relates to restricting user or network permissions. These may result in administrator confusion or a lack of clarity around the permissions available to a specific component.
- Flaws in inter-component authentication which allow a suitably positioned malicious user to escalate permissions to cluster-admin.
- Weaknesses in logging and auditing which could be abused by an attacker post-compromise to aid in maintaining persistence or stealth once in control of a cluster.
- Flaws in user input sanitisation which allow a restricted form of authentication bypass by modifying the request made to the etcd datastore.
Очень круто, что к
K8s есть такое пристальное внимание со стороны ИБ.