Service
RESOURCEAn abstraction that exposes a set of Pods as a network service
A Service gives your Pods a stable network identity. Since Pods are ephemeral and their IPs change when they restart, you need something consistent to point at. That’s what a Service does. It provides a single DNS name and IP that routes traffic to the right Pods using label selectors.
There are different Service types: ClusterIP (internal only, the default), NodePort (exposes on each node’s IP at a static port), LoadBalancer (provisions an external load balancer in cloud environments), and ExternalName (maps to a DNS name outside the cluster).
Attacked and defended in
24 OFFENSIVE Abusing Kubernetes API Server Proxy LATERAL MOVEMENT OFFENSIVE Active Internal Network Reconnaissance RECONNAISSANCE OFFENSIVE Cluster Reconnaissance via Prometheus RECONNAISSANCE OFFENSIVE Compromising etcd via Pod Creation CREDENTIAL ACCESS OFFENSIVE Data Exfiltration via Kubernetes Events EXFILTRATION DEFENSIVE Detecting API Server Proxy Abuse DEFENSIVE Detecting Argo Workflows Abuse via Audit Logs DEFENSIVE Detecting Data Exfiltration via Kubernetes Events DEFENSIVE Detecting Impersonation Abuse DEFENSIVE Detecting kubectl debug Activity via Audit Logs DEFENSIVE Detecting Orphan Pod Masquerading via Audit Logs DEFENSIVE Disable Automatic Mounting of Default Service Account Tokens OFFENSIVE GKE Anonymous Reconnaissance RECONNAISSANCE DEFENSIVE Hiding Services from Enumeration OFFENSIVE Internal Cluster Discovery RECONNAISSANCE OFFENSIVE Passive Secret Discovery via kube-state-metrics RECONNAISSANCE OFFENSIVE Persistence via Unbound Service Account Tokens PERSISTENCE OFFENSIVE Privilege Escalation via serviceaccounts/token Permission PRIVILEGE ESCALATION DEFENSIVE Restricting Prometheus Endpoint Access OFFENSIVE Secret Exfiltration via ApplicationSet Generators CREDENTIAL ACCESS DEFENSIVE Securing ArgoCD Application Access OFFENSIVE Weaponizing Argo Workflows PRIVILEGE ESCALATION OFFENSIVE Weaponizing ArgoCD Application PRIVILEGE ESCALATION OFFENSIVE Weaponizing Pod Creation Access PRIVILEGE ESCALATION