Identifying and Analyzing Vulnerabilities and Exploits in On-Premises Kubernetes

Kubernetes (K8s) is an open-source orchestration platform that revolutionizes how organizations deploy, manage, and scale containerized applications. Many organizations use K8s for their cloud environment and on-premises due to its benefits, such as service discovery, load-balancing, and helf-healing. However, the misconfigurations in Role-Based Access Control (RBAC), exposed APIs on insecure ports, overly privileged containers, and vulnerabilities in container runtime or K8s lead to exploits. The goal of this research is to analyze critical vulnerabilities and exploits related to container cryptojacking, breakout, and privilege escalation, identify key logs from both Linux and K8s, and develop log correlation rules to detect unknown attacks in on-premises K8s. Using the Nunamaker methodology for a structured approach to information system development, the article begins with an introduction to the topic, contextualizes the research, reviews the state of the art, and identifies vulnerabilities and exploits in K8s. This is followed by a description of the modeling, implementation, and integration of the systems. Quantitative and qualitative evaluations of the systems and insights gained from these assessments conclude the paper.