Kubernetes Misconfiguration

CriticalDevOps SecurityOWASP Kubernetes Security

Kubernetes clusters deployed with insecure defaults, overly permissive RBAC policies, missing network segmentation, or exposed dashboards enable container escape, lateral movement, and cluster compromise.

Immediate Response

1Restrict or disable access to exposed Kubernetes dashboards and API endpoints.
2Remove privileged security contexts and run containers as non-root users.
3Revoke overly permissive RBAC bindings and apply least-privilege principles.
4Isolate compromised pods and nodes for forensic investigation.

All playbooks

1Implement NetworkPolicies with default-deny and explicit allow rules.
2Enable Kubernetes audit logging and forward logs to SIEM for monitoring.
3Deploy admission controllers (OPA Gatekeeper, Kyverno) to enforce security policies.
4Scan cluster configurations with kube-bench and CIS Kubernetes Benchmark tools.

Long-term Prevention

1Implement pod security standards (PSS) to restrict privileged operations cluster-wide.
2Use service mesh (Istio, Linkerd) for mTLS and fine-grained traffic control.
3Conduct regular Kubernetes penetration testing and red team exercises.
4Establish cluster lifecycle management with automated security patching.

Attack vectors

Pods running with privileged security context or root user
Overly permissive RBAC roles granting cluster-admin to service accounts
Missing NetworkPolicies allowing unrestricted pod-to-pod communication
Exposed Kubernetes API server or dashboard without authentication

Indicators of compromise

Kubernetes audit logs showing unauthorized API calls or privilege escalation
Pods with hostNetwork, hostPID, or privileged security contexts
Service accounts with cluster-admin bindings or excessive permissions
Network traffic between pods in different namespaces without authorization

Tooling

kube-benchkube-hunterKubescapeFalcoOPA Gatekeeper