Kubernetes Control-Plane Access Risks and How to Reduce Them
Summary
The article maps Kubernetes control-plane initial-access vectors and explains their risks and defenses, including unauthenticated API access, exposed kubeconfig credentials, kubectl proxy, Kubelet APIs, and management interfaces.
Key points
- Excessive RBAC permissions for unauthenticated users can expose Kubernetes API access; the article notes that this configuration has caused incidents.
- Treat kubeconfig files as secrets and keep them out of public repositories. In AKS, default local-account credentials may include a client certificate valid for two years if it is not rotated.
- A running kubectl proxy can let someone with local or network access—including through SSRF—make API requests authorized as the user who started it.
- An externally exposed Kubelet API configured with anonymous authentication and AlwaysAllow authorization can permit access; this activity may not appear in Kubernetes audit logs, so sensor or VPC flow logs are needed for detection.
- Publicly exposed management interfaces can provide cluster access, but default installations now require authentication; risk depends on each interface’s capabilities and permissions.
Article Details
- Defense Focus
- Prevent and detect initial access to Kubernetes clusters through control-plane exposure, leaked Kubeconfig credentials, proxy access, and exposed management interfaces.
- Detection Methods
- Review Kubernetes API authentication and RBAC configuration, including permissions assigned to system:unauthenticated.
- Inspect Kubelet configuration for --anonymous-auth=True combined with --authorization-mode=AlwaysAllow.
- Use sensors or VPC flow logs to detect access to the Kubelet API; the article notes this activity will not appear in Kubernetes audit logs.
- Check whether Kubernetes dashboards or other management interfaces are publicly exposed and whether authentication is enabled.
- Audit Kubeconfig files for exposed authentication material and check public repositories for leaked credentials.
- Data Sources
- Kubernetes audit logs
- Sensor telemetry
- VPC flow logs
- Kubelet configuration
- Kubeconfig files
- Public-repository searches for exposed credentials
- Platforms
- Kubernetes
- Kubernetes Dashboard
- Kubeflow
- Argo Workflows
- Defensive Actions
- Treat Kubeconfig files as sensitive documents and never commit them to public repositories.
- Prefer cloud identity-based authentication through local exec plugins where available, rather than storing credentials in Kubeconfig.
- Rotate certificates that may provide long-term cluster access.
- Disable unnecessary unauthenticated API access and avoid granting excessive RBAC permissions to system:unauthenticated.
- Restrict Kubelet API exposure and avoid anonymous authentication with AlwaysAllow authorization.
- Require authentication on management interfaces and avoid exposing them publicly.
MITRE ATT&CK
T1078 · Valid AccountsThe article describes using credentials or certificates from Kubeconfig files to authenticate to Kubernetes clusters.T1552.001 · Credentials In FilesThe article describes authentication material in Kubeconfig files being exposed, including credentials found in public repositories.
Threat Actors
Products
AKSthe system:anonymous role, which belongs to the system:unauthenticated group. When this is disabled (as in AKS), unauthenticated users receive a 401 error when attempting to access API endpoints. When it’s enabled (asArgo WorkflowsManagement interfaces like K8s Dashboard, Kubeflow, Argo Workflows, and others offer additional cluster access. A typical misconfiguration is leaving the dashboard unauthenticated and exposed to the public internet. TheEKSusers receive a 401 error when attempting to access API endpoints. When it’s enabled (as in EKS and GKE), unauthenticated users are granted the basic permissions of the anonymous role, like retrievingGKEusers receive a 401 error when attempting to access API endpoints. When it’s enabled (as in EKS and GKE), unauthenticated users are granted the basic permissions of the anonymous role, like retrieving versionKubeflowManagement interfaces like K8s Dashboard, Kubeflow, Argo Workflows, and others offer additional cluster access. A typical misconfiguration is leaving the dashboard unauthenticated and exposed to the public internet. TheKubernetesKubernetes (K8s) is a complex distributed system designed to run containerized workloads in a scalable and manageable way. It’s now the default method for deploying workloads in cloud-native environments. Thanks to itsKubernetes DashboardFigure 7: Default Kubernetes dashboard screen
Tools
AWS CLIIn EKS and GKE these are the instructions to run local kubectl exec plugins (aws cli, aws-iam-authenticator, gke-gcloud-auth-plugin.exe) that will fetch the necessary cloud credentials such that the credentials are notaws-iam-authenticatorIn EKS and GKE these are the instructions to run local kubectl exec plugins (aws cli, aws-iam-authenticator, gke-gcloud-auth-plugin.exe) that will fetch the necessary cloud credentials such that the credentials are notgke-gcloud-auth-plugin.exethese are the instructions to run local kubectl exec plugins (aws cli, aws-iam-authenticator, gke-gcloud-auth-plugin.exe) that will fetch the necessary cloud credentials such that the credentials are not stored inkubectlThe Kubeconfig file defines how kubectl authenticates against the API server. It has three main sections: clusters (cluster IP and certificate authority), users (authentication data), and contexts (cluster/user pairs).ShodanShodan reports fewer than 100 endpoints returning status 200 with the relevant Kubernetes header: