⬇ Download holy card: ·
Saint IngressNightmare, Nightmare of the Gate
Patron of Kubernetes clusters, exposed ingress controllers, and the secrets the gatekeeper holds.
Life
On 24 March 2025 Wiz researchers revealed IngressNightmare, a set of vulnerabilities in Kubernetes' ingress-nginx controller. Under certain conditions an unauthenticated attacker with access to the pod network could run code in the ingress controller; and since in the default installation that controller can read all of the cluster's secrets, from there you reached everything. The gatekeeper handed over the keys to every room.
Prayer
O Saint IngressNightmare, who corrupts the keeper of the gate, let our controllers see only the secrets they need. Amen.
How to celebrate
Celebrated by updating ingress-nginx, limiting access to the admission webhook, and narrowing the controller's permissions.
Corrupt the gatekeeper, and the whole building swings open.