Kubernetes Grey Zone: Risks in Managed Cluster Middleware

This blog post examines security risks introduced by managed cluster middleware (MCM) in cloud-managed Kubernetes offerings (AKS, EKS, GKE), demonstrates two attack chains—privilege escalation via Node Problem Detector custom plugins and Fluent Bit ConfigMap poisoning—that can achieve periodic root execution on hosts, token exfiltration, lateral movement, and persistence, and recommends mitigations such as avoiding root containers, using namespace granularity, CSP-side image minification, and increased transparency about worker-node components.