Back to all scenarios
Scenario #220
Security
K8s v1.19, AWS EKS
Weak Pod Security Policies Leading to Privileged Containers
Privileged containers were deployed due to weak or missing Pod Security Policies (PSPs), exposing the cluster to security risks.
Find this helpful?
What Happened
The absence of strict Pod Security Policies allowed containers to run with elevated privileges, leading to a potential security risk as malicious pods could gain unauthorized access to node resources.
Diagnosis Steps
- 1Inspected the cluster configuration and found that PSPs were either missing or improperly configured.
- 2Verified that certain containers were running as privileged, which allowed them to access kernel-level resources.
Root Cause
Weak or missing Pod Security Policies allowed privileged containers to be deployed without restriction.
Fix/Workaround
• Created and applied strict Pod Security Policies to limit the permissions of containers.
• Enforced the use of non-privileged containers for sensitive workloads.Lessons Learned
Strict Pod Security Policies are essential for securing containers and limiting the attack surface.
How to Avoid
- 1Implement and enforce strong Pod Security Policies to limit the privileges of containers.
- 2Regularly audit containers to ensure they do not run with unnecessary privileges.