domains / families / security / kubernetes-pentesting

kubernetes-pentesting

separate

Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.

When to use

• Kubernetes API server access
• RBAC enumeration
• Service account token abuse
• etcd secrets extraction
• Kubelet API exploitation
• Cloud IMDS access (EKS/GKE/AKS)
• Admission webhook bypass
• Network policy evasion

When not to use

• Escaping from a compromised pod to the underlying node
• Escalating to root on a node
• Pivoting between nodes
• Bypassing Pod Security Standards or seccomp profiles
• Exploiting SSRF to reach the K8s API or cloud metadata

Skill page

Source