Skip to main content

Kubernetes and Cloud-Native

Containers orchestrated by Kubernetes across managed cloud services (EKS, GKE, AKS) and self-managed clusters. This subcategory covers the Kubernetes control plane, workload security, container escape, managed-cluster attack paths, and defense.

Scope​

  • Kubernetes architecture: control plane (API server, etcd, scheduler, controller manager), nodes (kubelet, kube-proxy, container runtime), workloads (Pods, Deployments, StatefulSets, DaemonSets).
  • Identity and authorization: ServiceAccounts, RBAC, admission controllers, OIDC integration with cloud IAM (IRSA on EKS, Workload Identity on GKE).
  • Attack surface: exposed API server, kubelet, dashboard, misconfigured RBAC, privileged pods, hostPath mounts, cloud metadata access from pods.
  • Container escape: privileged containers, host namespace sharing, kernel exploits, runtime socket access.
  • Managed cloud paths: EKS IRSA abuse, GKE Workload Identity abuse, AKS pod identity, node pool privilege escalation.
  • Defense: Pod Security Standards, admission control (OPA/Gatekeeper, Kyverno), network policies, runtime detection (Falco), audit logging.

Files​

#FileTrack
01Kubernetes FundamentalsTwo-track
02Kubernetes Attack SurfaceTwo-track
03Container EscapeTwo-track
04GKE and EKS Attack PathsTwo-track
05Kubernetes Defense and DetectionTwo-track

Format​

Two-track: each file covers the offensive and defensive side.

Sections (11):

  1. Overview
  2. Reconnaissance and Enumeration
  3. Common Attack Vectors
  4. Exploitation Recipes
  5. Post-Exploitation
  6. Preventive Controls
  7. Detection Controls
  8. Verification
  9. Cloud-Specific Considerations
  10. Production Notes
  11. References

Each file also includes a ## Certification Alignment section.

Certification Alignment​

Core certifications for this subcategory:

  • CKA - Certified Kubernetes Administrator
  • CKS - Certified Kubernetes Security Specialist
  • CompTIA Security+

Extended certifications:

  • Google Cloud Professional Cloud Security Engineer
  • AWS Certified Security - Specialty
  • Azure Security Engineer Associate
  • AWS subcategory (cloud IAM, metadata service, EKS integration)
  • Azure subcategory (AKS, Entra ID workload identity)
  • GCP subcategory (GKE, Workload Identity)
  • CLOUD/06 Infrastructure as Code (cluster provisioning)

Authorized Use Only​

CAUTION

All techniques in this subcategory are for authorized security testing only. Kubernetes clusters, cloud accounts, and container runtimes must be tested only with explicit written authorization from the owner. Unauthorized access to cloud infrastructure is illegal in most jurisdictions and violates the terms of service of every cloud provider.

References​