​
Event Information

​
Meaning

  • This event indicates that a pod in the Kubernetes cluster is making outbound connections to common miner pool ports. Miner pool ports are commonly used by cryptocurrency mining software to connect to mining pools for resource-intensive mining operations.
  • It could be a sign of unauthorized cryptocurrency mining activity taking place within the cluster, which can consume significant computing resources and impact the performance of other applications running in the cluster.
  • To investigate this event, you can use the following kubectl command to identify the pod making the outbound connections: kubectl get pods --all-namespaces -o wide. This will provide information about the pods running in the cluster, including their IP addresses and namespaces.

​
Remediation

  1. Create a Kubernetes Deployment manifest file to deploy a Python script as a container:
apiVersion: apps/v1
kind: Deployment
metadata:
  name: remediation-script
spec:
  replicas: 1
  selector:
    matchLabels:
      app: remediation-script
  template:
    metadata:
      labels:
        app: remediation-script
    spec:
      containers:
      - name: remediation-script
        image: python:3
        command: ["python", "-u"]
        args: ["remediation_script.py"]
  1. Create a Kubernetes Service manifest file to expose the deployment:
apiVersion: v1
kind: Service
metadata:
  name: remediation-script-service
spec:
  selector:
    app: remediation-script
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80
  1. Create a Python script named remediation_script.py that uses the Kubernetes Python API to perform the remediation actions:
import os
from kubernetes import client, config

# Load the in-cluster Kubernetes configuration
config.load_incluster_config()

# Create a Kubernetes API client
api_client = client.ApiClient()

# Define the remediation actions here
# For example, you can delete the Pods that triggered the event
def remediate_event():
    v1 = client.CoreV1Api(api_client)
    namespace = os.getenv("POD_NAMESPACE")
    pod_name = os.getenv("POD_NAME")
    v1.delete_namespaced_pod(pod_name, namespace)

# Call the remediation function
remediate_event()

Note: Make sure to replace the remediation actions with the appropriate actions for your specific use case.