s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

DevSecOps & cloud securityPlatform series

How a pod becomes cluster admin

A pod does not need a vulnerability to become cluster admin. It needs a ServiceAccount token, a permissive RoleBinding and a namespace that still allows privileged pods. Here is the path.

Quick reference

  1. A token is stolen — A compromised pod reads its mounted ServiceAccount token. · *token*
  2. List secrets — It reads Secrets in its namespace, including credentials. · *secrets*
  3. Find a privileged SA — A RoleBinding shows which ServiceAccount can create pods. · *rbac*
  4. Create a pod as that SA — The API server runs the new pod with the stronger identity. · *pod create*
  5. Mount the node — hostPath / exposes the node filesystem and kubelet creds. · *hostPath*
  6. Take the cloud role — Node instance profile gives the pod cloud rights. · *cloud*

Explained

The path

  1. A token is stolen. Every pod mounts a projected token at /var/run/secrets/kubernetes.io/serviceaccount/token unless automount is disabled. A compromised container reads it first.
  1. List secrets. If the ServiceAccount can list Secrets in its namespace, credentials come back in plaintext: database passwords, API keys, sometimes a cloud key. It is the most common RBAC over-grant.
  1. Find a privileged SA. RoleBindings show which accounts can create pods. The CI account often can, and its Role may also allow Secrets or pods/exec. kubectl auth can-i --list --as=system:serviceaccount:shop:api answers it.
  1. Create a pod as that SA. Anyone who can create a pod can usually set serviceAccountName in the spec. The API server admits it; the kubelet mounts the stronger token.
  1. Mount the node. With hostPath: /, the container reads the node's filesystem, often including the kubelet kubeconfig.
  1. Take the cloud role. The metadata endpoint at 169.254.169.254 may return the node's instance profile credentials. The cluster admin is now the cloud account.

Where it stops

The honest caveat: Pod Security Admission at baseline or restricted rejects hostPath and privileged pods, so this chain needs a namespace that allows them. Inventory it first.

The lesson: the token is not the breach; the binding behind it is.

In one line

One pod is the whole cluster. A stolen token is a foothold; weak RBAC makes it the account.

Prove the path

kubectl auth can-i create pods

More notes: DevSecOps & cloud security

Open in the notes app: search, filters, copy This note on GitHub