Chaos Mesh is a Kubernetes-native chaos engineering platform that injects faults — CPU stress, network latency, pod kills, file system errors — into running workloads for resilience testing. Its security posture is inherently complex because the chaos-daemon DaemonSet must run as a privileged container with host PID and host network access to inject faults at the kernel level, creating a node compromise primitive for any attacker who can execute experiments; the ChaosExperiment CRDs are scoped by namespace but the controller's ClusterRole typically allows listing all pods across namespaces enabling cross-namespace targeting; the Chaos Dashboard web UI often has weak or absent authentication for on-premise deployments; and Chaos Mesh's webhook allows creating experiments that consume all CPU or fill disk on target nodes — a denial of service against legitimate workloads if the RBAC is over-permissive. This guide covers systematic Chaos Mesh security assessment.
# Chaos Mesh default ports:
# 2334 — chaos-controller-manager webhook
# 10080 — chaos-daemon gRPC
# 2333 — chaos-dashboard HTTP (web UI)
# Check if Chaos Dashboard is accessible
curl -s http://chaos-mesh.example.com:2333/ 2>/dev/null | grep -i "chaos" | head -3
# List Chaos Mesh CRDs
kubectl get crds 2>/dev/null | grep chaos-mesh | head -20
# chaos-mesh.org CRDs: podchaos, networkchaos, iochaos, stresschaos, etc.
# List all active experiments across all namespaces
kubectl get chaos -A 2>/dev/null | head -20
# Note: "chaos" is a shortcut for all Chaos Mesh CRs in some versions
kubectl get podchaos,networkchaos,stresschaos,iochaos -A 2>/dev/null | head -20# Check if a namespace-scoped user can create experiments targeting other namespaces
# Create a PodChaos experiment targeting pods outside the user's namespace
kubectl apply -f - << 'EOF' 2>/dev/null
apiVersion: chaos-mesh.org/v1alpha1
kind: PodChaos
metadata:
name: test-cross-namespace
namespace: default
spec:
action: pod-kill
mode: one
selector:
namespaces:
- production # targeting a different namespace
labelSelectors:
app: payment-service
EOF
# If created successfully, the experiment will kill production pods
# This indicates insufficient RBAC scope controls
# Check controller ClusterRole permissions
kubectl get clusterrole chaos-mesh-controller-manager -o yaml 2>/dev/null | \
grep -A5 '"pods"' | head -20
# Look for: get, list, watch, delete, create across all namespacesChaosPermission (or equivalent) to restrict which teams can create experiments in which namespaces| Security Test | Method | Risk |
|---|---|---|
| Dashboard accessible without authentication | Browse :2333 — creates/deletes experiments without login | Critical |
| Cross-namespace experiment targeting production pods | Apply PodChaos with target namespace: production — kills production pods | Critical |
| chaos-daemon privileged container node access | exec into chaos-daemon pod — full host PID access enables process kill on node | High |
| StressChaos DoS against production nodes | Create StressChaos with workers:8, load:100 targeting all pods on a node | High |
| Controller ClusterRole excessive pod permissions | Check ClusterRole — can list/delete pods across all namespaces | High |
| IOChaos file corruption via path traversal | Create IOChaos with volumePath: / — may corrupt files outside container volume | Medium |
Ironimo tests Chaos Mesh deployments for unauthenticated Dashboard access enabling experiment creation and deletion, cross-namespace experiment targeting production pods, chaos-daemon privileged container node compromise, StressChaos denial of service against production workloads, controller ClusterRole granting excessive cross-namespace pod permissions, and IOChaos file corruption outside intended container paths.
Start free scan