What happened:
We identified the usage of a combination of configuration parameters:
Undefined runAsUser
Undefined runAsNonRoot
Undefined readOnlyRootFilesystem
[missing] resources.limits
If parameters are undefined, Kubernetes will apply default values
This combination may result in resource exhaustion (CPU/memory) and privileged container execution, which can crash pods or destabilize the node (Denial of Service). Malicious or misbehaving containers can consume excessive resources or manipulate the filesystem, leading to unplanned outages or degraded performance.
We provide supporting evidence from https://madhuakula.com/kubernetes-goat/docs/scenarios/scenario-13/denial-of-service-memory-and-cpu-resources-in-kubernetes-cluster which demonstrates how missing resource constraints and running as root can be abused to perform DoS attacks on nodes.
|
containers: |
|
- image: litmuschaos/chaos-exporter:1.13.6 |
|
imagePullPolicy: Always |
|
name: mysql-exporter |
|
ports: |
|
- containerPort: 9104 |
|
name: mysql-metrics |
|
- image: grafana/grafana:latest |
|
imagePullPolicy: Always |
|
name: grafana |
What you expected to happen:
Containers should be deployed with defined resource requests and limits to enforce fair CPU/memory usage.
The securityContext should not rely on defaults.
Where can this issue be corrected? (optional)
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?:
What happened:
We identified the usage of a combination of configuration parameters:
If parameters are undefined, Kubernetes will apply default values
This combination may result in resource exhaustion (CPU/memory) and privileged container execution, which can crash pods or destabilize the node (Denial of Service). Malicious or misbehaving containers can consume excessive resources or manipulate the filesystem, leading to unplanned outages or degraded performance.
We provide supporting evidence from https://madhuakula.com/kubernetes-goat/docs/scenarios/scenario-13/denial-of-service-memory-and-cpu-resources-in-kubernetes-cluster which demonstrates how missing resource constraints and running as root can be abused to perform DoS attacks on nodes.
litmus/monitoring/utils/metrics-exporters-with-service-monitors/litmus-metrics/chaos-exporter/chaos-exporter.yaml
Lines 21 to 23 in 92e8e95
litmus/monitoring/utils/metrics-exporters-with-service-monitors/mysqld-exporter/deployment.yaml
Lines 33 to 36 in 92e8e95
litmus/monitoring/utils/grafana/deployment.yaml
Lines 18 to 20 in 92e8e95
What you expected to happen:
Containers should be deployed with defined resource requests and limits to enforce fair CPU/memory usage.
The securityContext should not rely on defaults.
Where can this issue be corrected? (optional)
How to reproduce it (as minimally and precisely as possible):
Anything else we need to know?: