Breaking Namespace Isolation on EKS via AWS Authentication Design
September 7, 2026 #kubernetes #aws #cloud
Namespace isolation on EKS does not hold as a security boundary: any workload that can reach the instance metadata service can assume its worker node’s Kubernetes identity and read the secrets referenced by co-located pods in other namespaces. Two attack scenarios demonstrate the impact, together with the mitigations that limit it.