Shopify Overexposed Scans GKE Ingresses and Cloud Run for Exposure

6.7 relevance

Shopify's GKE exposure scanner, actionable for cloud security and observability

Cloud infoq.com

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a platform engineer or cloud architect, this demonstrates a practical pattern for reconciling infrastructure-as-code intent with cluster-enforced reality, using Cloud Asset Inventory to avoid credential sprawl and SSRF-hardened probes to validate exposure without false positives.

Key Takeaways

Adopt a cluster-state scanner over repo-based checks for ingress exposure detection, using Cloud Asset Inventory and anonymous HTTP probes with SSRF mitigations.

Shopify Overexposed Scans GKE Ingresses and Cloud Run for Exposure

Summary

Shopify rebuilt its Overexposed scanner on GCP Cloud Asset Inventory and anonymous HTTP probes to detect internet-accessible Kubernetes Ingresses on GKE and Cloud Run services lacking authentication. The original repository-based approach produced false alarms from proxy annotations and admission controller rewrites, and missed Ingresses created outside the infra repo. The new scanner reduced inconclusive verdicts by ~80% by querying the cluster's actual state, probing with HEAD/GET requests and path variations like /ADMIN, and classifying results into six verdicts including 'expected' for allowlisted endpoints.

Author

Claudio Masolo