The Importance of Penetration Testing Kubernetes

Kubernetes, which means “helmsman” in Ancient Greek, is an open-source platform for managing clusters and containerized applications. Kubernetes makes it possible to deploy and manage containers at scale. A container is essentially a piece of software that contains all the components an application needs to function. Kubernetes manages all these containers through orchestration. It also handles automatic scaling, routing, and much more. Kubernetes has many components and is therefore often perceived as complex. Below is an example of a Kubernetes architecture:

The advantage of Kubernetes is that it is an open-source software product. This means that, in principle, anyone has access to the product’s source code, which promotes transparency. The frequency of security testing on Kubernetes is increasing, as it is being scrutinized by multiple organizations and individuals. Although this is positive, the software itself is often not the weakest link in the chain. Kubernetes is a relatively complex and new technology with many configuration and implementation options. We’ve noticed that while organizations implement new technologies, they often lack the necessary knowledge to configure and maintain them properly. As a result, misconfigurations are almost inevitable. People are generally the weakest link when it comes to security risks. A configuration error is easy to make and can have disastrous consequences for digital security in your IT environment.

After conducting multiple Kubernetes penetration tests, we have concluded that there is a trend of common security issues among companies that have implemented this technology. For a Kubernetes penetration test, a OneXillium consultant visits the client’s site. While conducting this Kubernetes penetration test, we believe it is important to maintain close communication with the client’s system administrators in order to provide insight into where improvements need to be made. We have observed that Kubernetes is perceived as complex and, for many system administrators and application developers, is a relatively new technology for which in-depth knowledge is often still lacking. As a result, they are not always aware of the security risks associated with Kubernetes implementations.

We frequently observe certain security risks during Kubernetes penetration tests that recur across various clients. A common security issue is misconfigurations within the cluster. It is crucial to configure the clusters correctly so that network policies and access controls are properly set up. Kubernetes’ default settings are not secure enough, which means many organizations are unaware that they are at risk. Partly due to these default settings and misconfigurations during setup, Kubernetes clusters have proven in practice to be relatively easy to compromise, which can have major consequences for an organization’s operations and reputation.

While conducting penetration tests, we encountered several scenarios in which web applications were hosted on a Kubernetes environment. Due to a combination of misconfigurations on the platform and insufficiently applied updates to the software in use, it was possible to gain access to the underlying system on which the platform was hosted. As a result, attackers were able to move further through the network, gaining access to the organization’s digital “crown jewels”—which could have had serious consequences if a criminal had been able to exploit this vulnerability. By having the Kubernetes environment penetration tested and following the recommendations resulting from the penetration test, malicious actors will no longer have a chance, allowing you to rely on your IT services with confidence.