How Ctadel accesses the cluster
The cluster is discovered during the account inventory, region by region. Ctadel requests the kubeconfig from the region’s OKS API. A kubeconfig provided in the application takes precedence.
Kubernetes
OUTSCALE OKS
Your OKS clusters are discovered from the connected OUTSCALE account, SecNumCloud region included, and read through their API, with no agent in the cluster.
What is read
Workloads, service accounts, RBAC, network policies, secrets and configmaps, nodes and images. Running images are analysed for vulnerabilities. The cluster enters the same graph as the cloud account hosting it: a privileged pod on a node reachable from the internet becomes a link of an attack path.
- Privileged container or container running as root
- API server exposed without address restriction
- Service account with a cluster-admin role
- Running image with a known exploited vulnerability
See it on your accounts
The online demonstration is open to all, on fictitious data. For an instance on your own accounts, request a demonstration.