3 ms·
This is super interesting. If you actually look at a Loadbalancer logs without a WAF in place, you will see huge amount of bot activity. What is not clear in t
by debarshri 3y ago
This is super interesting. If you actually look at a Loadbalancer logs without a WAF in place, you will see huge amount of bot activity.
What is not clear in the blogs is how did they actually accessed the API server without a valid service token. Secondly, they index alot on IPs, that implied these are k8s cluster that are not managed (EKS, GKE etc).
Is my assumption correct?
- abatilo 3y agoThe GKE "default" is to bind a public IP to your control plane. So these could still be managed
- raesene9 3y agoSo it is possible to expose Kubernetes without auth (https://raesene.github.io/blog/2023/03/18/lets-talk-about-anonymous-access-to-Kubernetes/ https://raesene.github.io/blog/2023/03/18/lets-talk-about-an... has some details) but it's not a default You can make that mis-configuration with managed distros, which are generally exposed to the Internet by default.
- debarshri 3y agoAh that's what it is. Opening up API server that's allows anonymous auth is a very bad idea.