At a very high level, we're going to view how kube‑hunter works.
We are also going to leverage this diagram as we step through the
demo within this course. Let's get started.
It all starts with the Kubernetes control plane. The control
plane, and pretty much all Kubernetes components, are hosted
within your data center or cloud environment.
The control plane is the brain of the Kubernetes cluster and
is usually composed of multiple servers.
It also houses critical APIs for controlling the cluster.
Now,
all administrative functionality for the cluster
occurs within the control plane.
Obviously, this is a juicy target for attackers.
The control plane controls the worker nodes.
In other words,
the worker servers. The worker nodes run the non‑administrative workloads.
In other words,
the worker nodes run workloads that do not control
the overarching Kubernetes cluster.
In this course, we will run an Apache web server.
This server runs within a Pod, and a Pod is composed of one or more containers.
You can think of a Pod as the smallest unit that can be deployed
within a Kubernetes cluster. As you might expect, this Apache Pod
is instantiated on a worker node.
So, as a little bit of an aside, in our demo environment
everything in this slide will be hosted on one node,
which is your local workstation.
However, if you are inspecting a real Kubernetes cluster,
it will probably map to what you are seeing in this diagram.
In other words, there will be multiple servers involved.
Okay. As I previously said, the control plane controls the worker nodes,
but how exactly does this work?
This occurs through the kubelet. At a very high level, the kubelet
enforces policies that are set within the control plane.
We will dive heavily into the kubelet in this course. In particular,
we'll see what can occur when the kubelet is compromised.
Now let's turn our focus back to the Apache Pod.
The Apache Pod is created from a container image that is
housed within the container image registry.
The container image registry can be within your data center or it can
be hosted by a third party, such as Docker Hub.
In this course,
we're going to be leveraging container images from Docker Hub.
Anyhow, the kubelet downloads the images from the registry and
uses the image to instantiate the Pod.
In this course,
we're going to see how a misconfiguration in the kubelet can be
leveraged to compromise the image registry. And last but not least,
where does kube‑hunter fit within all of this?
In this course, we're going to take the remote perspective.
In other words,
we're going to be analyzing the Kubernetes cluster from a remote viewpoint.
Specifically, kube‑hunter audits the Kubernetes worker nodes and
the control plane servers. As you might expect, this is the
perspective that attackers can take as well.
Well, all right.
While these diagrams were needed to lay our foundation,
I'm starting to get some PowerPoint fatigue. From here on out,
we'll be in the demo environment getting some hands‑on experience.
Next up is installing the demo environment. Come on and join me.