Hacker News Reader

This is super interesting. If you actually look at a Loadbalancer logs without a WAF in place, you will see huge amount of bot activity.

What is not clear in the blogs is how did they actually accessed the API server without a valid service token. Secondly, they index alot on IPs, that implied these are k8s cluster that are not managed (EKS, GKE etc).

Is my assumption correct?

View on HN

So it is possible to expose Kubernetes without auth (https://raesene.github.io/blog/2023/03/18/lets-talk-about-an... has some details) but it's not a default

You can make that mis-configuration with managed distros, which are generally exposed to the Internet by default.

Ah that's what it is. Opening up API server that's allows anonymous auth is a very bad idea.

The GKE "default" is to bind a public IP to your control plane. So these could still be managed

Reply on news.ycombinator.com