Every #Kubernetes cluster admin MUST watch "Advanced Persistence Threats" session from @IanColdwater @bradgeesaman #KubeCon #CloudNative. So much knowledge and goodness - thanks for sharing. I've been trying to get people to understand this attack vector for a long time 👇 
You all did a much better job than me articulating it. Ahhh!!! Watching this hurts! I even wrote a chapter on this in Kubernetes Best Practices O'Reilly book. I wake up in cold sweats knowing how easy it is to leave this open! Biting my nails again.
Heartburn watching this. I suspect my pain isn't going to stop here. Anxious for what's going to happen here.
Crap - now we are bypassing the API server with a shadow API server. I need to sit down for this
I'm just going to leave this here
I love how casual both Ian and Brad sound throughout this session - "I'm just going to dump all the secrets on the cluster out via the shadow API server". It's almost like listening to a David Attenborough documentary. Meanwhile - I have heart palpitations.
C2BERNETES! I don't even want to know my blood pressure right now
Me watching this session
Please look at this diagram long and hard. "I think we could install a control-plane component on another cloud (who blocks tcp 443?). With cluster admin on the target cluster we can deploy a workload that escapes the container to the underlying host on every worker node." Brad
"From there, we can install the k3s node in the background with a configuration to auto-join our k3s cluster on start and then the container just exists a couple of seconds after establishing that persistence. The end result is having access to the host file system"
"And the best part is, the target cluster is still fully operational. We didn't break anything to make this happen. The next time the cluster admin runs kubectl get pods, they won't even know a thing or see any logs" -- I believe that's a mic drop right there.
This is the stuff of nightmares. But I'm honestly thankful that Ian and Brad are sharing this.
Demoing this exploit on *KS clusters from all providers..... When you both run for president - just share this image for your candidacy announcement statement. It's proof enough. Frakenhonk!
Casually "How's that for a multi-cloud strategy" says Ian. Nothing but net 🏀🗑️
Just grabbing all mounted secrets from all nodes. Nothing to see here.
Now grabbing cloud credentials. I think I'm going to turn my computer off now unplug it from electricity.
Now reviving kubelet-exploit. 2020 is really the gift that keeps on giving. This flower is making me happy though
Look ma, no hands!
OH: kube-proxy
Absolutely awesome session! Thanks again
Hang around for the Q&A. It's very insightful. Margarita time for me.
