Back to all scenarios
Scenario #234
Security
K8s v1.19, On-Premise
Compromised Image Registry Access Credentials
The image registry access credentials were compromised, allowing attackers to pull and run malicious images in the cluster.
Find this helpful?
What Happened
The credentials used to access the container image registry were stored in plaintext in a config map, and these credentials were stolen by an attacker, who then pulled a malicious container image into the cluster.
Diagnosis Steps
- 1Reviewed configuration files and discovered the registry access credentials were stored in plaintext within a config map.
- 2Analyzed logs and found that a malicious image had been pulled from the compromised registry.
Root Cause
Storing sensitive credentials in plaintext made them vulnerable to theft and misuse.
Fix/Workaround
• Moved credentials to Kubernetes Secrets, which are encrypted by default.
• Enforced the use of trusted image registries and scanned images for vulnerabilities before use.Lessons Learned
Sensitive credentials should never be stored in plaintext ; Kubernetes Secrets provide secure storage.
How to Avoid
- 1Always use Kubernetes Secrets to store sensitive information like image registry credentials.
- 2Implement image scanning and whitelisting policies to ensure only trusted images are deployed.