Back to all scenarios
Scenario #203
Security
K8s v1.21, Azure AKS
Privileged Container Vulnerability Due to Incorrect Security Context
A container running with elevated privileges due to an incorrect security context exposed the cluster to potential privilege escalation attacks.
Find this helpful?
What Happened
A container was configured with privileged: true in its security context, which allowed it to gain elevated permissions and access sensitive parts of the node.
Diagnosis Steps
- 1Inspected the pod security context with kubectl describe pod and found that the container was running as a privileged container.
- 2Cross-referenced the container's security settings with the deployment YAML and identified the privileged: true setting.
Root Cause
Misconfigured security context allowed the container to run with elevated privileges, leading to security risks.
Fix/Workaround
• Removed privileged: true from the container's security context.
• Applied the updated deployment and monitored the pod for any security incidents.Lessons Learned
Always avoid using privileged: true unless absolutely necessary for certain workloads.
How to Avoid
- 1Review security contexts in deployment configurations to ensure containers are not running with excessive privileges.
- 2Implement automated checks to flag insecure container configurations.