> For the complete documentation index, see [llms.txt](https://moharat.gitbook.io/cylabs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://moharat.gitbook.io/cylabs/security-domains/kubernetes-security.md).

# Kubernetes Security

* Kubernetes Architecture
* Kubernetes Attack Surface
  * Control Plane 
    * etcd
    * master nodes
* Kubernetes Secure Configurations
  * Public traffic to cluster is proxied through load balancer
  * Cluster RBAC
* Kubernetes Threat Model
* Tools 
  * Penetration Testing tool : <https://github.com/inguardians/peirates>&#x20;
  * Trivy Vulnerability scanner : <https://github.com/aquasecurity/trivy>
  * Deepce : Docker Enumeration <https://github.com/stealthcopter/deepce>
* Attack Paths
  * subdomain enumeration -> S3 bucket scan
  * Web application exploitation -> api call exploitation -> RCE ->SSRF -> access to pods
    * Ex: java struts running on internet facing pod (CVE-2017-5638)
  * Nuclei templates -> subdomains/api's&#x20;

References:&#x20;

1. <https://www.gitops.tech/>
2. <https://control-plane.io/posts/hardening-git-for-gitops/>
3. <https://www.aquasec.com/blog/kubernetes-vulnerability-security-threat/>
4. <https://www.microsoft.com/en-us/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/>
5. <https://attack.mitre.org/matrices/enterprise/containers/>
6. <https://github.com/OWASP/Docker-Security/blob/main/dist/owasp-docker-security.pdf>
7. <https://research.nccgroup.com/2017/11/23/kubernetes-security-consider-your-threat-model/>