Kubernetes is a popular and powerful tool for workload management, and doesn’t always have the best security defaults. Even the best-intentioned engineers may define insecure configurations which lead to critical misconfigurations in production.At Cruise, we use Kubernetes for a multi-tenant Platform as a Service (PaaS). One of the hardest things to get right was effective tenant isolation in a mulit-tenant container environment.For attackers: this combination of freedom-without-guardrails potentially exposes workloads and clusters to issues such as pulling assets from untrusted sources, accidental public exposure, elevated privileges, etc. We provide cases when this has gone wrong (i.e. known vulnerabilities), and walk through how to exploit them. For attackers, this is a pwning k8s 101 talk, no dropping 0dayz here.For defenders: we wrote a tool to prevent this. K-rail is a tool for workload policy monitoring and enforcement in Kubernetes that enables you to safely lock down your cluster while maintaining high developer productivity. During this talk we will open source this tool, and share some common policies from lessons learned of running this in production at Cruise.No matter what colour hat you wear, you'll come away from the talk with an understanding of what kinds of security issues commonly arise within k8s environments, some effective policies to deploy in your environment, how to deploy them, and a new tool for doing so.