Cluster State Manipulation

critical

cluster-state-manipulation

Attacker directly modifies cluster state in etcd, bypassing Kubernetes API server admission controllers and RBAC to create privileged workloads, modify RBAC rules, or corrupt cluster configuration

TamperingElevation of Privilege

MITRE ATT&CK techniques

IDNameTactic
T1565 Data Manipulation Impact
T1078 Valid Accounts Defense Evasion

Common Weakness Enumeration

Mitigating controls

ctrl-clusterstate-1
Restrict direct etcd access to only the Kubernetes API server
ctrl-clusterstate-2
Require mutual TLS (mTLS) for all etcd client connections
ctrl-clusterstate-3
Run etcd on dedicated nodes with no other workloads
ctrl-clusterstate-4
Enable etcd audit logging and monitor for direct API access
ctrl-clusterstate-5
Implement network policies to isolate etcd from pod network

References