API Server
COMPONENTThe central management component that exposes the Kubernetes API
The API server (kube-apiserver) is the front door to your Kubernetes cluster. Every interaction, whether from kubectl, controllers, or the kubelet, goes through it. It handles authentication, authorization, admission control, and then persists the validated objects to etcd.
Because everything flows through the API server, securing it is critical. This includes enabling RBAC, configuring proper authentication methods, using admission controllers to enforce policies, enabling audit logging, and restricting network access. If the API server is compromised or misconfigured (like allowing anonymous auth), an attacker can control the entire cluster.
Attacked and defended in
29 OFFENSIVE Abusing Kubernetes API Server Proxy LATERAL MOVEMENT OFFENSIVE Active Internal Network Reconnaissance RECONNAISSANCE OFFENSIVE Cluster Reconnaissance via Prometheus RECONNAISSANCE OFFENSIVE Compromising ArgoCD via Application Sync PRIVILEGE ESCALATION OFFENSIVE Compromising etcd via Pod Creation CREDENTIAL ACCESS OFFENSIVE Data Exfiltration via Kubernetes Events EXFILTRATION DEFENSIVE Detecting API Server Proxy Abuse DEFENSIVE Detecting Argo Workflows Abuse via Audit Logs DEFENSIVE Detecting Data Exfiltration via Kubernetes Events DEFENSIVE Detecting Impersonation Abuse DEFENSIVE Detecting kubectl debug Activity via Audit Logs DEFENSIVE Detecting Orphan Pod Masquerading via Audit Logs DEFENSIVE Detecting Permission Enumeration via Audit Logs DEFENSIVE Disable Automatic Mounting of Default Service Account Tokens DEFENSIVE Enforcing Read-Only Container Filesystems OFFENSIVE GKE Anonymous Reconnaissance RECONNAISSANCE OFFENSIVE Internal Cluster Discovery RECONNAISSANCE OFFENSIVE Kubernetes Impersonation PRIVILEGE ESCALATION OFFENSIVE Passive Secret Discovery via kube-state-metrics RECONNAISSANCE OFFENSIVE Persistence via Unbound Service Account Tokens PERSISTENCE OFFENSIVE Privilege Escalation via serviceaccounts/token Permission PRIVILEGE ESCALATION DEFENSIVE Restricting Prometheus Endpoint Access OFFENSIVE Rogue Static Pod Deployment PERSISTENCE OFFENSIVE Secret Exfiltration via ApplicationSet Generators CREDENTIAL ACCESS DEFENSIVE Securing ArgoCD Application Access OFFENSIVE ServiceAccount Token Theft CREDENTIAL ACCESS OFFENSIVE Weaponizing Argo Workflows PRIVILEGE ESCALATION OFFENSIVE Weaponizing ArgoCD Application PRIVILEGE ESCALATION OFFENSIVE Weaponizing Pod Creation Access PRIVILEGE ESCALATION