services / Google Cloud / Services

Services provide a stable network endpoint for one or more pods, allowing them to be accessed by other pods or external clients.

Services control how your Kubernetes Pods are exposed on the Kubernetes network.

container.​services.​create

Services open up communication to your pods from other Kubernetes workloads. Depending on other settings in the Kubernetes cluster and the presence of ingress controllers, it may allow public exposure as well.

Risks

1. Network movement (BOOST)

Scope: CRITICAL

This privilege may grant access to sensitive data from a significant fraction of organizational functions, allow interruption of critical organizational services, or its exploit could lead to significant privilege escalation.

Links