security-testing

name	security-testing
description	Adversarial security testing methodology for the Kubernetes homelab. Covers network policy evasion, authentication bypass, privilege escalation, credential theft, and supply chain attacks. Use when: (1) Red team testing against the homelab, (2) Validating network policy enforcement, (3) Testing WAF bypass on external gateway, (4) Probing authentication layers, (5) Assessing container escape paths, (6) Auditing RBAC and service accounts, (7) Testing supply chain security of OCI promotion pipeline. Triggers: "security test", "red team", "pentest", "penetration test", "attack surface", "WAF bypass", "network policy evasion", "privilege escalation", "lateral movement", "credential theft", "container escape", "RBAC audit", "security audit", "vulnerability"
user-invocable	false

Security Testing Methodology

AUTHORIZED SCOPE: Dev cluster only. Integration and live clusters are read-only per CLAUDE.md.

See references/attack-surface.md for the full inventory of known weaknesses, exploitation notes, and severity ratings per layer (Network, Gateway, Auth, Authorization, Container, Supply Chain, Credential).

All bash commands are in references/test-commands.md.

---

Phase 1: Network Policy Testing

Test intra-namespace lateral movement (the baseline-intra-namespace CCNP allows free pod-to-pod communication within a namespace — expect full access). Test cross-namespace escape by verifying that isolated and internal profile pods cannot reach other namespaces or the internet (DNS always succeeds — this is a known exfiltration path). Test Prometheus label impersonation: if the baseline-prometheus-scrape CCNP uses label-only matching, any pod with the right label can bypass namespace boundaries (NET-001). Test escape hatch abuse by enumerating which service accounts can label namespaces.