Namespace isolation on EKS does not hold as a security boundary: any workload that can reach the instance metadata service can assume its worker node’s Kubernetes identity and read the secrets referenced by co-located pods in other namespaces. Two attack scenarios demonstrate the impact, together with the mitigations that limit it.
Kubernetes is a widely used open-source container orchestration system that helps to reduce workloads when dealing with container management in distributed systems. Its built-in authorization module is enabled by default and provides authorization mechanisms that prevent unauthorized access to resources. However, certain permissions enable their subject to escalate their privileges to a potentially Cluster compromising extent.
Hands-on practice is an efficient way for penetration testers to gain in-depth knowledge of a certain skill or technology. Providing hands-on practice
requires setting up an environment for test and training purposes. Setting up
a test environment manually can be time-consuming and very frustrating. This is
caused by long installation processes and configuration procedures. Besides that,
setting up big test environments can be expensive due to the necessary
infrastructure or computational power.
Developing a solution based on local virtualization is possible, but is still
limited to local resources. Instead, this problem can be solved using cloud computing.