Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes security vulnerability (CVE-2020-8554)

Workarounds and Mitigations

You can mitigate this vulnerability by using Kubernetes role-based access control (RBAC) to limit the users authorized to create and update Kubernetes services. You can further mitigate this vulnerability by controlling network traffic for classic or VPC clusters. Refer to the Kubernetes security advisory CVE-2020-8554: Man in the middle using LoadBalancer or ExternalIPs for more information on this vulnerability along with options for restricting the use of external IPs. Be sure to review Accessing the cluster master via admission controllers and webhooks if you deploy a webhook to your cluster. Refer to the Tigera blog New Vulnerability Exposes Kubernetes to Man-in-the-Middle Attacks: How to Mitigate CVE-2020-8554 for more information on this vulnerability and an overview of how network policies can be used to mitigate this vulnerability. Note that IBM Cloud Kubernetes Service does not support Calico Enterprise.

You can monitor your cluster for external IP usages by running the following command:

kubectl get svc --all-namespaces -o go-template='
{{- range .items -}}
  {{if .spec.externalIPs -}}
    {{.metadata.namespace}}/{{.metadata.name}}: {{.spec.externalIPs}}{{"\n"}}
  {{- end}}
{{- end -}}
'

You are encouraged to enable Kubernetes API server auditing to monitor your cluster for evidence of this vulnerability being exploited.