Kubernetes cluster attacks target the container orchestration platform to gain unauthorized access, escalate privileges, and move laterally across containerized workloads. As Kubernetes becomes the standard for container deployment, it presents a complex attack surface spanning API servers, etcd datastores, node infrastructure, and workload configurations.
Kubernetes attacks target multiple components. The API server, if exposed or misconfigured, allows anonymous or low-privilege access to cluster operations. RBAC misconfigurations grant excessive permissions to service accounts, enabling privilege escalation through pod creation with hostPath mounts or privileged security contexts. Etcd access (port 2379) provides direct access to all cluster secrets and configurations. Compromised pods with access to the node's Docker socket or containerd socket enable container escape. Service account token theft from pod filesystem (/var/run/secrets) provides authenticated API access. Kubelet API exposure (port 10250) allows pod listing and command execution. Network policy gaps enable lateral movement between namespaces. Tools like kube-hunter, peirates, and kubectl-exploit automate common attack patterns.
Kubernetes clusters often host an organization's most critical applications and process sensitive data. The platform's complexity creates a large configuration surface where a single misconfiguration can compromise the entire cluster. Default Kubernetes installations prioritize functionality over security, meaning organizations must actively harden their clusters. Understanding Kubernetes attacks is essential for securing modern application infrastructure.
CDA addresses Kubernetes attacks within the VSD and SPH domains. Theater missions include cluster assessment and hardening exercises. Our approach treats Kubernetes security as an operational discipline requiring continuous configuration management rather than one-time hardening.