Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why the hell is your Kubernetes API public?

leebriggs.co.uk

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Why the hell is your Kubernetes API public?

#21

Post by withinboredom »

belter wrote: post #2

"...For reasons I can’t quite understand, we’ve sort of collectively decided that it’s okay to put our Kubernetes control planes on the public internet. At the very least, we’ve sort of decided it’s okay to give them a public IP address..." Is that what Google does with Borg? ;-) "...Many of the developers at Google working on Kubernetes were formerly developers on the Borg project. We've incorporated the best ideas…

I worked at a company where everything was exposed to the internet. There was no vpn, except for getting access to key infra, like databases and caches. All our reporting, support tools, etc was freely available; if you had the right cookies.

Re: Why the hell is your Kubernetes API public?

#24

Post by weikju »

vbezhenar wrote: post #7

It is public, so what? Obviously cloud operators consider it secure enough to offer that option by default. What are the reasons to consider it not secure?

While I agree is likely secure enough, remember that cloud operators such as Aws used to be ok with making s3 buckets public by default, which did cause many issues until they finally changed that (and made it harder to make them public even intentionally).

Re: Why the hell is your Kubernetes API public?

#26

Post by tzakrajs »

xg15 wrote: post #15

I think something doesn't quite add up in OP's claim. Having full access to the control plane effectively let's you do anything you want with the cluster. If there were really millions of completely unsecured Kubernetes instances lying around, we should see all kinds of worms and botnets already taking advantage of them - and we should also see lots of attempted probes/attacks to infect new instances as soon as they…

Back in 2020 I once accidentally kept my personal k8s api open and got hit by a drive-by k8s-in-k8s bitcoin miner attack, it deployed an operator and it failed to run correctly but it created a ton of pods in my default namespace.

Re: Why the hell is your Kubernetes API public?

#27

Post by benlivengood »

AWS endpoints are similarly publicly accessible, protected by single access keys or session keys. That's the nature of the Internet. Your VPN endpoints are also publicly accessible; anyone with credentials or a RCE in the VPN endpoint can get through.

At some point you just trust the common shared public key libraries that protect public APIs and VPNs.

Re: Why the hell is your Kubernetes API public?

#28

Post by linuxdude314 »

maxcoder4 wrote: post #16
xg15 wrote: post #15

I think something doesn't quite add up in OP's claim. Having full access to the control plane effectively let's you do anything you want with the cluster. If there were really millions of completely unsecured Kubernetes instances lying around, we should see all kinds of worms and botnets already taking advantage of them - and we should also see lots of attempted probes/attacks to infect new instances as soon as they…

Of course that's how it works, there are various authentication methods that must be completed [2] to do anything. The author's claim is that similarly like you shouldn't expose RDP to the public internet, you shouldn't expose your k8s API. In practice the difference is that while RDP (or database or WordPress) credentials are vulnerable to bruteforce, in almost all cases k8s clusters are secured by either mtls or jw…

This is the way. Even in a zero trust environment, it’s wise to have your cluster endpoints internal to a VPC. Zero trust doesn’t mean no internal network, but rather no internal trusted zone.

It’s still a great idea to minimize the “blast radius” where you can.

Re: Why the hell is your Kubernetes API public?

#30

Post by dilyevsky »

belter wrote: post #2

"...For reasons I can’t quite understand, we’ve sort of collectively decided that it’s okay to put our Kubernetes control planes on the public internet. At the very least, we’ve sort of decided it’s okay to give them a public IP address..." Is that what Google does with Borg? ;-) "...Many of the developers at Google working on Kubernetes were formerly developers on the Borg project. We've incorporated the best ideas…

Google never did that with Borg. In fact when I worked there there wasn’t even a way to talk to borg api from your laptop other than going via your personal workstation in the office
Post reply on HN