What is Kubernetes security and how does a cluster actually get hacked?

#kubernetes #k8s #containersecurity Kubernetes security defends four layers. Clusters fall through the workload layer: one reachable pod, five moves, cluster-admin. One reachable pod becomes cluster-admin in five moves, and every move rides a single line of YAML that someone typed on purpose. This video walks the real chain: foothold, service account token, RBAC escalation, container escape, cloud pivot. Then it shows the one control that cuts each link. In this video you will learn: - Why the workload layer, not the API server, is where most Kubernetes compromises start - How IngressNightmare (CVE-2025-1974, CVSS 9.8) turned one request into cluster-wide secret access - Why every pod ships a live API credential and the one line that stops it: automountServiceAccountToken: false - How a ClusterRoleBinding to cluster-admin and wildcard verbs turn one pod into the whole cluster - Why privileged: true plus a hostPath mount is a container escape without a kernel exploit - The five controls from the NSA/CISA hardening guide that break each link of the chain For platform engineers, SREs and security teams who run or review Kubernetes clusters in production. Sources: Red Hat State of Kubernetes Security Report 2024 (89% of organisations had at least one container or Kubernetes incident in 12 months); Wiz Research on CVE-2025-1974 IngressNightmare (6,500+ exposed admission controllers); Kubernetes docs on service account tokens and Pod Security Admission (PSP removed in v1.25); NSA/CISA Kubernetes Hardening Guide v1.2; Wired on the 2018 Tesla cryptojacking incident. Chapters follow the five steps of the compromise chain, then the fixes. K8s Under Attack is produced by Wiz, the cloud security platform that maps attack paths across Kubernetes and cloud accounts. Source: https://www.redhat.com/en/resources/state-kubernetes-security-report-2024-overview Subscribe to K8s Under Attack for one real cluster compromise chain, and the manifest line that stops it, every week. #kubernetes #k8s #containersecurity #RBAC #cloudnative #kubernetessecurity #devsecops #cloudsecurity #containers Chapters: 00:00 - What Kubernetes security is: four layers, one that gets attacked 00:51 - Step 1: the foothold (IngressNightmare) 02:03 - Step 2: the service account token 03:18 - Step 3: RBAC escalation to cluster-admin 04:33 - Step 4: container escape with privileged and hostPath 05:41 - Step 5: the pivot to the cloud account 06:44 - The five fixes that cut the chain 08:02 - One manifest away