  Kubernetes (K8s) has grown in popularity over the past few years to become
the de-facto standard for container orchestration in cloud-native environments.
While research is not new to topics such as containerization and access control
security, the Application Programming Interface (API) interactions between K8s
and its runtime interfaces have not been studied thoroughly. In particular, the
CRI-API is responsible for abstracting the container runtime, managing the
creation and lifecycle of containers along with the downloads of the respective
images. However, this decoupling of concerns and the abstraction of the
container runtime renders K8s unaware of the status of the downloading process
of the container images, obstructing the monitoring of the resources allocated
to such process. In this paper, we discuss how this lack of status information
can be exploited as a Denial of Service attack in a K8s cluster. We show that
such attacks can generate up to 95% average CPU usage, prevent downloading new
container images, and increase I/O and network usage for a potentially
unlimited amount of time. Finally, we propose two possible mitigation
strategies: one, implemented as a stopgap solution, and another, requiring more
radical architectural changes in the relationship between K8s and the CRI-API.
