If attackers gain access to the API or etcd, what information can they easily retrieve from the mounted volumes?

If attackers gain access to the API or etcd, what information can they easily retrieve from the mounted volumes?

• A. Privilege escalation scripts
• B. Configuration details of the mounted volumes
• C. User authentication credentials only
• D. Network topology

Answer: (B)

When you gain access to the API server or etcd, you can read the cluster’s stored state, including how volumes are configured and mounted for each pod. The specifications that describe which volume is used, where it’s mounted inside containers, whether it’s read-only, and references to PersistentVolumeClaims, Secrets, or StorageClasses are all stored and served by the API and backed by etcd. Because these details define the storage topology of the cluster, they are readily retrievable, giving an attacker a clear map of how volumes are wired and what resources they depend on. This exposure is why configuration details of the mounted volumes best describe what can be gleaned from that level of access. To mitigate this, enforce strict access controls on the API and etcd, and consider encryption and RBAC to limit who can read resource specifications and secrets.

When you gain access to the API server or etcd, you can read the cluster’s stored state, including how volumes are configured and mounted for each pod. The specifications that describe which volume is used, where it’s mounted inside containers, whether it’s read-only, and references to PersistentVolumeClaims, Secrets, or StorageClasses are all stored and served by the API and backed by etcd. Because these details define the storage topology of the cluster, they are readily retrievable, giving an attacker a clear map of how volumes are wired and what resources they depend on. This exposure is why configuration details of the mounted volumes best describe what can be gleaned from that level of access. To mitigate this, enforce strict access controls on the API and etcd, and consider encryption and RBAC to limit who can read resource specifications and secrets.