Kubernetes EKS Authentication internal workings and abuses

11 Dec 2024

Wanted to do a quick follow up/addition to this previous post here where I talked about Kubernetes authentication. This time around, I’m going to talk a little about the workings of the AWS EKS authentication extension for Kubernetes, which allows you to make calls to the Kubernetes API by authenticating using AWS credentials, so you can better understand how it can be abused.

More …

Kubernetes Internal Service Discovery

13 Dec 2023

This blog post talks about methods you can use from within a compromised container to discover additional accessible network services within a Kubernetes cluster. The post assumes you have obtained code execution in the compromised container, and want to use that access to attack other internal services within the cluster.

More …