Take Over the Whole Cluster: Attacking Kubernetes via Excessive Permissions of Third-party Applications

Yang, Nanzi; Shen, Wenbo; Li, Jinku; Liu, Xunqi; Guo, Xin; Ma, Jianfeng

doi:10.1145/3576915.3623121

Cited by 4 publications

(1 citation statement)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For instance, while the former want the best (network) performance for their workloads and also potentially exclusive access to certain compute infrastructure and accelerators, the latter are mainly concerned with optimizing the usage of hardware resources and ensuring different tenants are properly isolated. Naturally, CAs strive to honor service level agreements with their customers, but they also need to protect the clusters from potentially malicious tenants and thus may want to restrict accumulation of privileged workloads on a single node [3] or restrict the possibility for lateral movement of attackers by least privilege network firewall rules [1], [4]. Any kind of network segmentation solution must take both parties' requirements into account and attempt to reconcile them optimally.…”

Section: Introductionmentioning

confidence: 99%

Towards Intent-Based Scheduling for Performance and Security in Edge-to-Cloud Networks

Santos,

Truyen,

Baumann

et al. 2024

2024 27th Conference on Innovation in Clouds, Internet and Networks (ICIN)

View full text Add to dashboard Cite

Telecom vendors have adopted containerization to improve their software for heterogeneous edge-to-cloud networks. Container orchestration platforms face however challenges when adapting to the dynamic demands of multi-tenancy, often leading to performance and security conflicts between Cluster Administrators (CAs) and applications administrators. In this paper, we propose that network security and performance constraints should be directly integrated into the scheduler. By dynamically determining preferred network segments for each application, this approach will reduce the network attack surface, enhance resource utilization, and ensure improved performance. The presented prototype and evaluation is just a first step. A comprehensive solution must also support an intent-based interface to the scheduler that simplifies expression of cluster node segmentation constraints and thus frees the CA from node-level management. We outline the vision for such an intent-based interface and emulate it by means of traditional security groups.

show abstract

Section: Introductionmentioning

confidence: 99%