Longhorn is a lightweight, distributed block storage system for Kubernetes that provides persistent volumes with built-in replication. Its architecture deploys a manager pod per node and instance-manager pods that run I/O engines for each volume replica. Security concerns include: the Longhorn manager REST API (port 9500 by default) that in some configurations is accessible within the cluster without authentication and allows volume creation, deletion, and snapshot operations; instance-manager processes running with host-level privileges that expose gRPC ports; backup target settings stored in Longhorn ConfigMaps that contain S3 or NFS credentials in plaintext; and the Longhorn manager ServiceAccount holding broad Kubernetes RBAC permissions including the ability to read Secrets cluster-wide for volume encryption key management. This guide covers systematic Longhorn security assessment.
# Longhorn manager runs as a DaemonSet/Deployment with REST API on port 9500
# Check if Longhorn manager API is accessible
# Port-forward to Longhorn manager (if you have exec into cluster)
kubectl port-forward -n longhorn-system svc/longhorn-frontend 8080:80 2>/dev/null &
# Access Longhorn UI/API via port-forward
curl -s http://localhost:8080/v1/volumes 2>/dev/null | python3 -c "
import json,sys
try:
r = json.load(sys.stdin)
vols = r.get('data',[])
print(f'Volumes accessible: {len(vols)}')
for v in vols[:5]:
print(f\" Volume: {v.get('name','?')} size: {v.get('size','?')}\")
print(f\" Encrypted: {v.get('encrypted',False)}\")
print(f\" State: {v.get('state','?')}\")
except Exception as e:
print(f'Error: {e}')
"
# List all Longhorn volumes via kubectl
kubectl get volumes.longhorn.io -n longhorn-system 2>/dev/null | head -10
# Get volume details including encryption key reference
kubectl get volume.longhorn.io -n longhorn-system -o json 2>/dev/null | \
python3 -c "
import json,sys
r = json.load(sys.stdin)
spec = r.get('spec',{})
print(f'Encrypted: {spec.get(\"encrypted\",False)}')
print(f'EncryptionKeySecret: {spec.get(\"encryptionKeySecret\",\"none\")}')
print(f'EncryptionKeySecretNamespace: {spec.get(\"encryptionKeySecretNamespace\",\"none\")}')
" # Longhorn stores backup target credentials in Kubernetes Secrets
# Check the backup target secret referenced in Longhorn settings
# Get Longhorn settings to find backup target credential Secret
kubectl get setting.longhorn.io backup-target -n longhorn-system -o json 2>/dev/null | \
python3 -c "import json,sys; r=json.load(sys.stdin); print(r.get('value',''))"
# Shows backup target URL (e.g., s3://my-bucket@us-east-1/)
kubectl get setting.longhorn.io backup-target-credential-secret \
-n longhorn-system -o json 2>/dev/null | \
python3 -c "import json,sys; r=json.load(sys.stdin); print(r.get('value',''))"
# Shows Secret name containing AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
# Read the backup credential secret (if you have access to longhorn-system namespace)
kubectl get secret -n longhorn-system -o json 2>/dev/null | \
python3 -c "
import json,sys,base64
r = json.load(sys.stdin)
for k,v in r.get('data',{}).items():
print(f'{k}: {base64.b64decode(v).decode()}')
"
# May contain AWS access keys, S3 bucket credentials, NFS mount options longhorn-system namespace Secrets — backup credentials and volume encryption keys reside there| Security Test | Method | Risk |
|---|---|---|
| Longhorn UI accessible without authentication | curl longhorn-frontend:80/v1/volumes — returns volume list | High |
| Backup credential Secret readable | kubectl get secret backup-creds -n longhorn-system — exposes S3 keys | High |
| Volume encryption key Secret accessible | kubectl get secret encryption-key -n app-namespace — LUKS passphrase | High |
| Longhorn manager ClusterRole over-privilege | kubectl get clusterrole longhorn-manager — check verbs on secrets | High |
| Volume deletion via Longhorn API | DELETE /v1/volumes/{name} — deletes PVC data without PV reclaim protection | High |
| Cross-namespace volume attachment | Create PVC referencing existing PV — check Longhorn reclaim policy | Medium |
Ironimo tests Longhorn deployments for manager REST API unauthenticated access, backup target S3/NFS credential exposure, volume encryption key Secret access, Longhorn manager ClusterRole over-privilege, instance-manager process port exposure, cross-namespace volume attachment bypass, and network policy gaps allowing unauthorized access to storage management APIs.
Start free scan