Kubernetes penetration testing playbook. Use when targeting Kubernetes clusters via API server, RBAC enumeration, service account abuse, etcd access, Kubelet API, pod escape, cloud-specific metadata, admission webhook bypass, and registry secrets.

SKILL: Kubernetes Pentesting — Expert Attack Playbook AI LOAD INSTRUCTION : Expert Kubernetes attack techniques. Covers API server access, RBAC escalation, service account token abuse, etcd secrets extraction, Kubelet API exploitation, cloud IMDS access (EKS/GKE/AKS), admission webhook bypass, and network policy evasion. Base models miss the distinction between namespace scoped and cluster scoped RBAC, and overlook Kubelet's unauthenticated API. 0. RELATED ROUTING Before going deep, consider loading: [container escape techniques](../container escape techniques/SKILL.md) for escaping from a compromised pod to the underlying node [linux privilege escalation](../linux privilege escalation/SKILL.md) once on a node for escalating to root [linux lateral movement](../linux lateral movement/SKILL.md) for pivoting between nodes [linux security bypass](../linux security bypass/SKILL.md) when Pod Security Standards or seccomp profiles restrict your actions [ssrf server side request forgery](../ssrf server side request forgery/SKILL.md) when exploiting SSRF to reach the K8s API or cloud metadata 1. K8S API SERVER ACCESS 1.1 Anonymous Access Check 1.2 Token Based Authentication (from inside pod) 1.3 Certificate / Kubeconfig Authentication 2. RBAC ENUMERATION 2.1 Self Permission Check 2.2 Role and ClusterRole Enumeration 2.3 Dangerous RBAC Permissions Permission Risk Escalation Path pods/exec Critical Exec into any pod (access secrets, tokens) pods (create) Critical Create privileged pod → node access secrets (get/list) Critical Read all secrets including SA tokens serviceaccounts/token (create) Critical Generate token for any SA nodes/proxy High Proxy to Kubelet API escalate on roles Critical Grant yourself any permission bind on rolebindings Critical Bind any role to yourself impersonate Critical Impersonate any user/SA 3. SERVICE ACCOUNT TOKEN ABUSE 3.1 Token Location and Decoding 3.2 Escalation via Service Account 3.3 Token Generation 4. ETCD DIRECT ACCESS 5. POD ESCAPE TO NODE See [container escape techniques](../container escape techniques/SKILL.md) for detailed escape chains. Quick reference for K8s specific vectors: Vector Requirement Command hostPID spec.hostPID: true nsenter t 1 m u i n p bash hostNetwork spec.hostNetwork: true Access node services (Kubelet, etcd) hostPath / Volume mount of host root chroot /host bash Privileged container securityContext.privileged: true Mount host disk / nsenter 6. KUBELET API (Port 10250/10255) 7. CLOUD SPECIFIC ATTACKS 7.1 AWS EKS — IMDS Access 7.2 GCP GKE — Metadata API 7.3 Azure AKS — Managed Identity 8. ADMISSION WEBHOOK BYPASS Strategy Command/Method Excluded namespace kubectl get validatingwebhookconfigurations o yaml \ grep namespaceSelector → use excluded NS failurePolicy: Ignore If webhook server down → admission skipped Ephemeral containers kubectl debug POD it image=alpine (may not be covered) Static pods Place manifest in /etc/kubernetes/manifests/ on node (bypasses API admission) 9. CONTAINER REGISTRY ACCESS 10. NETWORK POLICY ENUMERATION & BYPASS Bypass strategies: DNS exfiltration (port 53 rarely blocked), allowed port tunneling, pod in unprotected namespace, hostNetwork: true bypasses pod network policies entirely. 11. TOOLS Tool Purpose Command kubectl K8s API interaction kubectl auth can i list kube hunter Automated K8s vulnerability scanning kube hunter remote TARGET peirates K8s pentesting from inside a pod ./peirates kubesploit Post exploitation framework for K8s Agent based C2 CDK Container/K8s exploitation toolkit ./cdk evaluate kubeletctl Interact with Kubelet API directly kubeletctl pods s NODE IP kubeaudit Cluster misconfiguration audit kubeaudit all 12. KUBERNETES PENTESTING DECISION TREE

kubernetes-pentesting