LoFP / developers may legitimately use nodeport for frontends without cloud load balancers, or for nonstandard networking. system:addon-manager patch reconciliation of existing nodeport services is excluded; create and update from addon-manager still alert.

Techniques

• T1133

Sample rules

GKE Exposed Service Created With Type NodePort

• source: elastic
• technicques:
  • T1133

Description

Detects creation or modification of a GKE Service with type NodePort. NodePort exposes a static port on every worker node that hosts matching pods, which widens the cluster’s external attack surface and can bypass load-balancer and firewall controls. Attackers may create NodePort Services to intercept traffic or establish a direct path into the cluster.

Detection logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.action:(
  "io.k8s.core.v1.services.create" or
  "io.k8s.core.v1.services.update" or
  "io.k8s.core.v1.services.patch"
) and gcp.audit.request.spec.type:"NodePort" and not (
  client.user.email:"system:addon-manager" and
  event.action:"io.k8s.core.v1.services.patch"
)