WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2022 • Jun 15, 2022

Kubernetes Security - Challenge and Opportunity

Marc Nimmerrichter

Did you know granting basic pod privileges can compromise your entire Kubernetes cluster? Discover how to defeat container escapes and transform your architecture into a defensible system.

Pause
Mute Enter Fullscreen
#1 about 2 min

Introduction to Kubernetes security challenges and opportunities

Exploring Kubernetes security challenges highlights potential pitfalls and opportunities for securing modern microservices architectures.

#2 about 3 min

Understanding Kubernetes architecture and core cluster components

Understanding the core architecture of a Kubernetes cluster provides the necessary foundation for analyzing potential workload security vulnerabilities.

#3 about 5 min

Configuring pods, deployments, and namespaces in Kubernetes

Structuring deployments with declarative configuration objects like pods and replica sets allows teams to version upgrades and build resilient microservices.

#4 about 2 min

Managing cluster access securely with admission control

Controlling access to the API server requires robust authentication, strict authorization for common operations, and admission controllers for granular permissions.

#5 about 2 min

Abstracting container communication utilizing robust overlay networks

Integrating generic container network interfaces simplifies distributed overlay networks while enabling dynamic internal pod communications across scaled physical node barriers.

#6 about 4 min

Isolating workloads using kernel namespaces and control groups

Containers secure applications by isolating processes with kernel namespaces and managing resource allocation via robust Linux control groups.

#7 about 4 min

Restricting container privileges using capability and seccomp profiles

Applying restrictive capability filters and seccomp profiles prevents compromised containers from manipulating root volumes and escalating base host privileges.

#8 about 3 min

Mapping the complete path of a cluster compromise

A full system compromise often starts with an initial application exploit that leads to a container shell and subsequent breakout into the worker node.

#9 about 5 min

Identifying software vulnerabilities and typical configuration weaknesses

Exposing privileged containers or weakening basic namespace protections introduces structural attack vectors that make runtime updates critical against container escape exploits.

#10 about 6 min

Demonstrating a container escape using kernel vulnerabilities

Exploiting the legacy dirty cow kernel vulnerability enables threat actors to override memory addresses and spawn a reverse shell on the host node.

#11 about 2 min

Governing cluster permissions through role-based access control

Misconfigured role-based access controls commonly allow developers to launch privileged pods that entirely bypass isolated boundaries to compromise target worker nodes.

#12 about 3 min

Hardening nodes using immutable operating systems and admission controls

Prevent disruptive runtime modifications by configuring immutable container operating systems and leveraging stringent pod security admission controls to strengthen overall cluster resilience.

#13 about 2 min

Securing internal pod communication with network security policies

Explicitly restricting internal pod-to-pod traffic using network security policies effectively addresses network communication risks overlooked by standard default open configurations.

#14 about 3 min

Mitigating inherent architectural threats within multi-tenant environments

Running unvetted untrusted workloads across multiple tenants mandates advanced architectural hardware defenses due to the inherent lack of strict hypervisor-level isolation.

#15 about 2 min

Leveraging automated toolsets for hardened basic cluster configurations

Leveraging modern automated auditing tools and custom security profiles helps ensure foundational baseline configurations remain robust against pervasive common container threats.

#16 about 3 min

Understanding default security postures across managed cloud providers

Relying purely on default configurations in managed Kubernetes platforms poses hidden risks since providers typically leave critical strict containment settings completely disabled.

Matching moments

4:40 min

Assessing common Kubernetes security incidents and misconfigurations

Rico Komenda Rico Komenda · WWC 2025

11:32 min

Audience questions on security, limitations, and Kubernetes crossover

Maurice Brinkmann · LIVE

3:43 min

Introduction to Kubernetes security context configurations

Dimitrij Klesev +1 · LIVE

1:59 min

Implementing standard Kubernetes cluster security practices

Ali Alp Ali Alp · WWC Europe 2026

4:19 min

Mapping the attack surface of a Kubernetes cluster

Andrew Martin · WWC 2022

1:50 min

Challenges of diagnosing services in secured Kubernetes clusters

Tom Crecelius Tom Crecelius · WWC Europe 2026

More from World Congress 2022

What the heck do "declarative" and "reactive" actually mean? thumbnail
30:40
almost 4 years ago

What the heck do "declarative" and "reactive" actually mean?

André Kovac

The Design and Evolution of C++ thumbnail
1:01:15
about 4 years ago

The Design and Evolution of C++

Bjarne Stroustrup

But, you're not Facebook thumbnail
31:12
about 4 years ago

But, you're not Facebook

Kristijan Ristovski

Communicate efficiently with Software Architecture Diagrams thumbnail
28:11
about 4 years ago

Communicate efficiently with Software Architecture Diagrams

Simon Lasselsberger

Get Ready for Jakarta EE 10! thumbnail
42:53
about 4 years ago

Get Ready for Jakarta EE 10!

Ivar Grimstad

Keep your code refactorable thumbnail
26:46
about 4 years ago

Keep your code refactorable

Gerrit Stapper

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

Run your agents in Kubernetes: Build once, deploy anywhere. But really?

Michal Salanci

Senior Systems Engineer at ESET Cybersecurity

Michal Salanci
Open session

World Congress 2026 North America

rm -rf: Horror Stories From Unsandboxed AI Agents (and How Docker Fixes This)

Rishab Kumar

Staff Developer Evangelist @ Twilio

Rishab Kumar
Open session

World Congress 2026 North America

Trust, But Verify: Continuous GPU Validation at Scale

Kyle Bell

VP of AI @ TensorWave

Kyle Bell
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova

Related videos

Kubernetes Security Best Practices thumbnail
23:08
WWC 2025 • 12 months ago

Kubernetes Security Best Practices

Rico Komenda

Enhancing Workload Security in Kubernetes thumbnail
44:00
LIVE • over 4 years ago

Enhancing Workload Security in Kubernetes

Dimitrij Klesev, Andreas Zeissner

Hacking Kubernetes: Live Demo Marathon thumbnail
46:36
WWC 2022 • about 4 years ago

Hacking Kubernetes: Live Demo Marathon

Andrew Martin

Turning Container security up to 11 with Capabilities thumbnail
28:47
WWC 2023 • almost 3 years ago

Turning Container security up to 11 with Capabilities

Mathias Tausig

From Build to Breach: Hacking Kubernetes Through the Supply Chain thumbnail
31:38
WWC Europe 2026 • about 1 month ago

From Build to Breach: Hacking Kubernetes Through the Supply Chain

Ali Alp

Mastering Kubernetes – Beginner Edition thumbnail
57:24
LIVE • over 3 years ago

Mastering Kubernetes – Beginner Edition

Hannes Norbert Göring

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.