Kubernetes

Runs and schedules containers across many machines.

Containers

Where It Sits

The small stack marks its layer. Beside it, each related technology links to its own page.

App
Framework
Web Server
Runtime
ContainersKubernetes
OS
Hypervisor
Firmware
Hardware
Data

It Runs

Kubernetes website (opens in a new tab)KubernetesContainers

Runs On

LinuxOperating System

See It in the Stack

About

Kubernetes runs and schedules containers across a fleet of machines, restarting and moving them as needed. On each Linux node a runtime such as containerd starts them, often from images built with Docker. Its control plane, the part that decides what runs where, is reached through the API server on port 6443 and is a high-value target.

How to Spot It

These are signs that a system runs Kubernetes, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.

Default port: 6443 (Kubernetes API server)
Default port: 10250 (kubelet)
Default port: 30000 to 32767 (NodePort services)

If It Has a Flaw

Kubernetes controls many machines at once, so a flaw in its control plane or a weak API server can hand an attacker the whole cluster.

If Kubernetes has a flaw, every container in the cluster is exposed, on every node, with the app inside each and the data that app can reach. The apps and runtimes shown are exposed only where they run in its containers, not where they are installed straight on a server.

Well-Known Flaws

Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where Kubernetes sits.

CVE-2018-1002105 (opens in a new tab)2018
API Server Privilege Escalation
Crafted requests could reach backend services through the API server, using its credentials.
Reach It exposed every pod on a node, the smallest unit Kubernetes runs, to commands sent as the trusted API server.

Stacks and Code

Kubernetes is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.