Profile My skills Saved Collections Edit profile Submit a skill

Kubernetes Misconfiguration

Detects insecure Kubernetes pod and container configurations including privileged containers, hostPID, hostNetwork, and missing resource limits.

zakirkun Updated
DevOps & Infra

File contents

Kubernetes Misconfiguration

Overview

Kubernetes misconfigurations can lead to cluster takeover and container escapes:

  1. privileged: true: Pod container with root-level host access
  2. hostPID: true: Pod shares host PID namespace — can see/kill host processes
  3. hostNetwork: true: Pod uses host network, bypassing network policies
  4. allowPrivilegeEscalation: true: Allows container processes to gain more privileges
  5. runAsRoot: true or no runAsNonRoot: Container runs as root
  6. No resource limits: Resource exhaustion DoS possible
  7. Wildcard RBAC permissions: resources: ["*"] with verbs: ["*"]

Remediation

  • Use securityContext with runAsNonRoot: true, allowPrivilegeEscalation: false
  • Apply readOnlyRootFilesystem: true
  • Set resource requests and limits
  • Follow principle of least privilege for RBAC

zakirkun/ice-tea/tree/main/skills/infra/kubernetes-misconfig commit 919cfa3ea5

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/kubernetes-misconfiguration