services / Google Cloud / Ingress for Google Kubernetes Engine

Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. Traffic routing is controlled by rules defined on the Ingress resource.

Creating an Ingress does not automatically expose Services. It also needs an Ingress Controller. Kubernetes Engine ships with a Google-hosted Ingress Controller. However, you can also choose to deploy another Ingress Controller, such as Nginx. Configuring other controllers requires manual setup of other Google Cloud components, like NAT gateway, Firewall rules, and VPC network.

container.​ingresses.​update

Ingress updates may take down public internet connection to Kubernetes services, or establish new connections, potentially opening up services for further exploitation by an attacker.

Risks

1. Network destruction (HIGH)
2. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links