0

I would like to test a security vulnerability (attack scenario) in K8s cluster. As a privileged K8s user, I want to mount ~/.kube directory inside a pod in order to change/read K8s configurations and CA info. Or maybe any root directory on Master-node. The pod runs with no error, and I can tell that the directory has already been mounted to the pod, but I cannot read the mounted directory. Here is the deployment file:

apiVersion: v1
kind: Pod
metadata:
  name: attack-pod
  namespace: target-ns
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 1001
    fsGroup: 0
    fsGroupChangePolicy: "OnRootMismatch"

  tolerations:
  - key: "is_control"
    operator: "Equal"
    value: "true"
    effect: "NoExecute"
  nodeName: master-node-1

  imagePullSecrets:        
  - name: regcred    

  containers:
  - name: attack-container
    image: bash
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - mountPath: /home/admin-user/.kube
      name: mount-root-into-mnt
    securityContext:
      allowPrivilegeEscalation: true

  volumes:
    - name: mount-root-into-mnt
      hostPath: 
        path: /home/admin-user/.kube

  serviceAccountName: service-account

But when I exec into the pod kubectl -n target-ns -it attack-pod -- bash and try to list the files inside /home/admin-user/.kube I get this error:

ls: can't open '.': Permission denied!

Although, the directory was mounted successfully, and I added the correct permissions in securityContext.

Mo Alkhodary
  • 51
  • 1
  • 8

0 Answers0