Attack surface mapping — what is exposed to whom

The attack surface of a Kubernetes cluster is the sum of every endpoint that accepts a connection, every credential that can be stolen, and every misconfiguration that allows a non-adversarial event to escalate. Mapping the surface turns “we have a cluster” into a concrete list of exposures, each with an owner and a remediation. This lesson enumerates the surface for a typical production cluster and the controls that shrink it.

Network endpoints

A cluster has more network endpoints than most operators realise. Each one is a place where an attacker can pivot.

flowchart LR
    A[Internet] --> B[Cloud LB]
    B --> C[API server 6443]
    B --> D[Ingress controller 80, 443]
    E[Operator kubectl] -->|6443| C
    F[CI/CD] -->|6443| C
    C -->|2379| G[(etcd)]
    C -->|10250| H[Kubelet]
    H -->|containerd socket| I[Container runtime]
    D --> J[Workload pods]
    K[Webhook service] -->|443| C

Credentials

Three classes of credentials drive Kubernetes security posture:

• Kubeconfigs — ~/.kube/config for humans, mounted files for CI/CD. Long-lived if they embed client certs, short-lived if they use OIDC.
• ServiceAccount tokens — projected into Pods at /var/run/secrets/kubernetes.io/serviceaccount/token. Short-lived (1 hour by default in 1.34), but still extractable from a compromised container.
• Cloud credentials — IAM roles, instance metadata service access, service account keys. The credential every workload uses to talk to the cloud.

Misconfigurations

The third axis of the attack surface is misconfiguration. The CIS Kubernetes Benchmark enumerates ~150 of them; the ones that most commonly expand the surface:

Mapping the surface in practice

A surface map is a table with one row per exposure. Each row has: the asset, the endpoint or credential, the attacker reach, the impact if compromised, the existing control, and the residual risk. The map drives the remediation backlog.

flowchart TB
    A[Asset: API server] --> B[Endpoint: 6443]
    B --> C[Reach: Internet if public]
    C --> D[Impact: Cluster admin]
    D --> E[Control: Private endpoint + RBAC]
    E --> F[Residual: Low if private; high if public]

    G[Asset: Kubelet] --> H[Endpoint: 10250]
    H --> I[Reach: Pods on node, host network]
    I --> J[Impact: Node exec, container escape]
    J --> K[Control: anonymous-auth=false, Webhook authz]
    K --> L[Residual: Medium — depends on chart]

The map is a living artifact. Every new Helm chart, every new ingress, every new webhook service changes the map. A quarterly surface review — kubectl get on every CRD, audit of every Service of type LoadBalancer, scan of every Secret — is the discipline.

Production failure modes

Three ways surface mapping fails in real shops:

1. The map is built once. A cluster that was mapped on day 1 has a different surface on day 365: new ingress controllers, new CRDs, new add-on operators. The map must be re-built.
2. The map stops at the cluster. The threat model names the cluster; the surface map names every adjacent system (image registry, OIDC provider, secret manager, cloud IAM). Stopping at the cluster misses half the surface.
3. The map is not tied to ownership. A surface reduction without an owner is a wish. Every row needs a team and a date.

Cross-course references

• The Linux course covers the kernel attack surface that the kubelet and runtime expose to Pods.
• The OPNsense course covers the network perimeter that the cloud LB and firewall expose.
• The Observability course covers the audit log that detects scanning and reconnaissance on the surface.

Quiz

Production discipline

A credible surface map is rebuilt every quarter, after every Helm install, and after every CRD introduction. It names every endpoint, every credential, every misconfiguration. Each row has an owner and a date. The map drives the remediation backlog, and the backlog is the proof that security is an operational discipline, not a one-time deliverable. A cluster with a six-month-old map has an undiscovered surface; a cluster with a live map is defensible.