Sharing Is Risk

We’ve all heard the idea that “Sharing is caring” before, but in multi-tenancy security, sharing isn’t caring, sharing is risk.

Any resource that’s shared between tenants presents an attack surface where a hostile tenant might try to gain unauthorised access to another tenant’s applications, or abuse shared resources to impact the availability of another tenant’s services.

Part of the reason this is tricky is that a lot of Kubernetes multi-tenancy leans on namespaces, and namespaces were originally designed as a way of organising resources, not as a security boundary. Security controls like RBAC, network policy and Pod Security Admission were layered on top later, and plenty of the software we install into clusters was written without multi-tenancy in mind at all.

In Kubernetes there are quite a few different shared resources that attackers might try to target.