Cross-cluster lateral movement in Terraform and Kubernetes environments

Sammanfattning

This thesis examines cross-cluster lateral movement in Kubernetes clusters provisioned by Infrastructure as Code, with a focus on Terraform-based environments. The thesis combines a literary study with experimental testing to analyse how misconfigurations can affect an attacker's progress within and between clusters. Three representative vulnerabilities were analysed, a writeable hostPath mount, misconfigured service accounts, and the exposure of managed identities. To evaluate these, a test environment was developed using Terraform, Kubernetes and Multipass. In addition, a vulnerability scanning tool was created. The tool was applied to both the local test environments and 11 public GitHub repositories to identify recurring misconfiguration patterns. The results revealed that in all scenarios lateral movement was possible within the cluster whereas movement between clusters was limited by architectural factors such as network isolation, authentication mechanisms and separation of trust domains. The analysis of the 11 external repositories showed that misconfigurations are often introduced early in the deployment process. The findings indicate that lateral movement does not depend solely on individual vulnerabilities but also on the combination of configuration choices and the system architecture. This shows the importance of having a multi-layered defence as well as early identification of misconfigurations to secure multi-cluster environments.