Cluster State Manipulation
criticalcluster-state-manipulation
Attacker directly modifies cluster state in etcd, bypassing Kubernetes API server admission controllers and RBAC to create privileged workloads, modify RBAC rules, or corrupt cluster configuration
TamperingElevation of Privilege
MITRE ATT&CK techniques
| ID | Name | Tactic |
|---|---|---|
| T1565 | Data Manipulation | Impact |
| T1078 | Valid Accounts | Defense Evasion |
Common Weakness Enumeration
Mitigating controls
ctrl-clusterstate-1- Restrict direct etcd access to only the Kubernetes API server
ctrl-clusterstate-2- Require mutual TLS (mTLS) for all etcd client connections
ctrl-clusterstate-3- Run etcd on dedicated nodes with no other workloads
ctrl-clusterstate-4- Enable etcd audit logging and monitor for direct API access
ctrl-clusterstate-5- Implement network policies to isolate etcd from pod network