KubeCon NA 2022 - Hardening against Kubernetes Hacks.pdf

The document summarizes how an attacker could exploit vulnerabilities and misconfigurations in a Kubernetes cluster to gain admin privileges. It outlines how an initial application vulnerability allows remote code execution in a container. The attacker then uses overly permissive roles and lack of security controls like read-only filesystems, pod security policies, and network policies to escalate privileges from the pod to cluster admin. Proper use of admission controls, network policies, explicit permissions and configuration, and scanning tools could help prevent this exploitation.