Kubernetes Threat Model (16%)

STRIDE Threat Model

STRIDE is a threat classification model developed by Microsoft. It provides a structured way to identify security threats by category. For each component, ask: could this be subject to STRIDE threats?

1. Spoofing — Impersonating someone or something (fake identity).
2. Tampering — Modifying data or code without authorization.
3. Repudiation — Denying an action that actually occurred.
4. Information Disclosure — Exposing data to unauthorized parties.
5. Denial of Service — Making a system unavailable.
6. Elevation of Privilege — Gaining unauthorized elevated access.

Trust Boundaries

Trust boundaries are the lines between areas of different trust levels. Crossing a trust boundary requires authentication and authorization. In Kubernetes, there are several critical trust boundaries.

• Internet to cluster — Ingress controllers, LoadBalancers.
• User to API server — Authentication and RBAC.
• API server to kubelet — kubelet API authentication.
• Pod to Pod — Network Policies.
• Pod to external — Egress controls.
• Node to node — Cluster network encryption.

Common Attack Vectors

Understanding common attack vectors helps you prioritize defenses. The most dangerous attacks are those that allow privilege escalation or persistence.

• Exposed Kubernetes dashboard — Unauthenticated access to cluster management.
• Exposed etcd — Direct access to the cluster database.
• Running privileged containers — Containers with host access.
• Weak RBAC — Overly permissive roles or bindings.
• Container escape — Breaking out of container isolation to the host.
• Supply chain attacks — Malicious container images or dependencies.

Persistence Threats

Persistence is how an attacker maintains access after the initial compromise. Kubernetes provides several mechanisms that can be abused for persistence.

Container-Specific Threats

Containers introduce unique threats that do not exist in traditional deployments. The shared kernel, image supply chain, and runtime behavior all present attack surfaces.

• Container escape — Exploiting kernel vulnerabilities to break out.
• Image poisoning — Using malicious base images from public registries.
• Secrets in environment variables — Exposed via /proc or kubectl describe.
• Privileged containers — Access to host devices and capabilities.
• Resource exhaustion — Crypto mining or DoS via resource abuse.

Mitigation Strategies

1. Use Pod Security Standards to restrict privileged containers.
2. Enable RBAC and follow least-privilege principles.
3. Encrypt etcd at rest and in transit.
4. Scan images for vulnerabilities before deployment.
5. Enable audit logging and monitor for anomalies.
6. Use Network Policies to segment traffic.
7. Rotate certificates and credentials regularly.

Key Commands

kubectl get pods -o json | jq '.items[] | select(.spec.containers[].securityContext.privileged==true)'
kubectl get pods -o json | jq '.items[] | select(.spec.hostNetwork==true)'
kubectl get serviceaccounts -A
kubectl auth can-i create pods --as=system:anonymous
kubectl get events --field-selector reason=FailedCreate