Google Online Security Blog
At the KubeCon EU 2022 conference in Valencia, security researchers from Palo Alto Networks presented research findings on “trampoline pods”—pods with an elevated set of privileges required to do their job, but that could conceivably be used as a jumping off point to gain escalated privileges.
The research mentions GKE, including how developers should look at the privileged pod problem today, what the GKE team is doing to minimize the use of privileged pods, and actions GKE users can take to protect their clusters.
Privileged pods within the context of GKE security
While privileged pods can pose a security issue, it’s important to look at them within the overall context of GKE security. To use a privileged pod as a “trampoline” in GKE, there is a major prerequisite – the attacker has to first execute a successful application compromise and container breakout attack.
While privileged pods can pose a security issue, it’s important to look at them within the overall context of GKE security. To use a privileged pod as a “trampoline” in GKE, there is a major prerequisite – the attacker has to first execute a successful application compromise and container breakout attack.
Because the use of privileged pods in an attack requires a first step such as a container breakout to be effective, let’s look at two areas:
- features of GKE you can use to reduce the likelihood of a container breakout
- steps the GKE team is taking to minimize the use of privileged pods and the privileges needed in them.
Reducing container breakouts
There are a number of features in GKE along with some best practices that you can use to reduce the likelihood of a container breakout:
There are a number of features in GKE along with some best practices that you can use to reduce the likelihood of a container breakout:
- Use GKE Sandbox to strengthen the container security boundary. Over the last few months, GKE Sandbox has protected containers running it against several newly discovered Linux kernel breakout CVEs.
- Adopt GKE Autopilot for new clusters. Autopilot clusters have default policies that prevent host access through mechanisms like host path volumes and host network. The container runtime default seccomp profile is also Privileged pod escalations in Kubernetes and GKE