# kubernetes-security.cloud

> A comprehensive reference for Kubernetes security concepts, topics, and best practices.

## Generated
- generatedAt: 2026-09-07T02:12:52.614Z
- source: astro content collections (topics, glossary, attack-paths)

## LLM usage notes
- This file is generated automatically on deploy; do not edit by hand.
- Compact catalog: https://kubernetes-security.cloud/llms.txt (this file).
- Full encyclopedia dump: https://kubernetes-security.cloud/llms-full.txt (every topic, glossary entry, tool, and mapped ATT&CK technique).
- Prefer JSON indexes for structured metadata; prefer `.md` URLs or `llms-full.txt` for full prose.
- Prefer `topics.json` for topic metadata, phases, MITRE IDs, and markdown URLs.
- Prefer `glossary.json` for glossary metadata and markdown URLs.
- Prefer `tools.json` for the security tool catalog.
- Prefer `techniques.json` for MITRE ATT&CK techniques mapped to topics on this site.
- For offensive topics, filter `category=offensive` then group/order by `phase`.
- Use `/topics/<topic-slug>.md` for full topic markdown plus extracted action headings and commands.
- Use `/glossary/<term-slug>.md` for full glossary markdown.
- `phase` is the canonical offensive classification field on topics.

## Important URLs
- Site home: https://kubernetes-security.cloud/
- About: https://kubernetes-security.cloud/about
- Topics overview: https://kubernetes-security.cloud/topics
- Glossary overview: https://kubernetes-security.cloud/glossary
- MITRE techniques index: https://kubernetes-security.cloud/techniques
- Security tools index: https://kubernetes-security.cloud/tools
- Machine-readable topic index (JSON): https://kubernetes-security.cloud/topics.json
- Machine-readable glossary index (JSON): https://kubernetes-security.cloud/glossary.json
- Machine-readable tools index (JSON): https://kubernetes-security.cloud/tools.json
- Machine-readable ATT&CK index (JSON): https://kubernetes-security.cloud/techniques.json
- Raw markdown topic endpoint pattern: https://kubernetes-security.cloud/topics/<topic-slug>.md
- Raw markdown glossary endpoint pattern: https://kubernetes-security.cloud/glossary/<term-slug>.md
- Full content dump: https://kubernetes-security.cloud/llms-full.txt
- Sitemap: https://kubernetes-security.cloud/sitemap-index.xml
- LLM index (this file): https://kubernetes-security.cloud/llms.txt

## Content totals
- Topics: 33 (offensive: 21, defensive: 12, fundamental: 0)
- Glossary entries: 34

## Offensive phase index (topics)
- credential-access: 3 topic(s)
- defense-evasion: 1 topic(s)
- exfiltration: 1 topic(s)
- lateral-movement: 1 topic(s)
- persistence: 2 topic(s)
- privilege-escalation: 8 topic(s)
- reconnaissance: 5 topic(s)

## Topic pages
- https://kubernetes-security.cloud/topics/abusing-kubernetes-api-server-proxy | md: https://kubernetes-security.cloud/topics/abusing-kubernetes-api-server-proxy.md | category: offensive | phase: lateral-movement | mitre: T1046, T1090, T1021 | Abusing Kubernetes API Server Proxy | Bypassing network policies and accessing internal services through the Kubernetes API server proxy subresource
- https://kubernetes-security.cloud/topics/abusing-kyverno-mutatingpolicy | md: https://kubernetes-security.cloud/topics/abusing-kyverno-mutatingpolicy.md | category: offensive | phase: privilege-escalation | mitre: T1578, T1610 | Abusing Kyverno MutatingPolicy | How MutatingPolicy access can be abused to change pods during admission in Kyverno
- https://kubernetes-security.cloud/topics/active-internal-network-reconnaissance | md: https://kubernetes-security.cloud/topics/active-internal-network-reconnaissance.md | category: offensive | phase: reconnaissance | mitre: T1046 | Active Internal Network Reconnaissance | Scanning internal cluster IP ranges from a compromised pod to discover open ports on services, pods, and nodes
- https://kubernetes-security.cloud/topics/cluster-reconnaissance-via-prometheus | md: https://kubernetes-security.cloud/topics/cluster-reconnaissance-via-prometheus.md | category: offensive | phase: reconnaissance | mitre: T1046, T1082, T1613 | Cluster Reconnaissance via Prometheus | Querying an unauthenticated Prometheus endpoint to map cluster topology without touching the Kubernetes API
- https://kubernetes-security.cloud/topics/compromising-argocd-via-application-sync | md: https://kubernetes-security.cloud/topics/compromising-argocd-via-application-sync.md | category: offensive | phase: privilege-escalation | mitre: T1548, T1098, T1078 | Compromising ArgoCD via Application Sync | Steering an Application destination into the argocd namespace so the controller overwrites argocd-rbac-cm and the submitter becomes an ArgoCD admin
- https://kubernetes-security.cloud/topics/compromising-etcd-via-pod-creation | md: https://kubernetes-security.cloud/topics/compromising-etcd-via-pod-creation.md | category: offensive | phase: credential-access | mitre: T1610, T1611, T1552, T1078 | Compromising etcd via Pod Creation | Steal etcd TLS via pod hostPath on the control plane
- https://kubernetes-security.cloud/topics/data-exfiltration-via-kubernetes-events | md: https://kubernetes-security.cloud/topics/data-exfiltration-via-kubernetes-events.md | category: offensive | phase: exfiltration | mitre: T1537, T1530 | Data Exfiltration via Kubernetes Events | How attackers can misuse Kubernetes Events to move data out after cluster compromise
- https://kubernetes-security.cloud/topics/detecting-api-server-proxy-abuse | md: https://kubernetes-security.cloud/topics/detecting-api-server-proxy-abuse.md | category: defensive | phase: n/a | mitre: none | Detecting API Server Proxy Abuse | Identifying abuse of the services/proxy and pods/proxy subresources to bypass network segmentation or use the API server as an open HTTP proxy
- https://kubernetes-security.cloud/topics/detecting-argo-workflows-abuse | md: https://kubernetes-security.cloud/topics/detecting-argo-workflows-abuse.md | category: defensive | phase: n/a | mitre: none | Detecting Argo Workflows Abuse via Audit Logs | Identifying unauthorized workflow creation, CronWorkflow persistence, and WorkflowTemplate poisoning by auditing argoproj.io resource events
- https://kubernetes-security.cloud/topics/detecting-data-exfiltration-via-events | md: https://kubernetes-security.cloud/topics/detecting-data-exfiltration-via-events.md | category: defensive | phase: n/a | mitre: none | Detecting Data Exfiltration via Kubernetes Events | Identifying abuse of the Kubernetes Events API to smuggle data out of a cluster through event message fields
- https://kubernetes-security.cloud/topics/detecting-impersonation-abuse | md: https://kubernetes-security.cloud/topics/detecting-impersonation-abuse.md | category: defensive | phase: n/a | mitre: none | Detecting Impersonation Abuse | Identifying impersonation abuse by inspecting the impersonatedUser audit field and reviewing which subjects hold the impersonate verb
- https://kubernetes-security.cloud/topics/detecting-kubectl-debug-activity-via-audit-logs | md: https://kubernetes-security.cloud/topics/detecting-kubectl-debug-activity-via-audit-logs.md | category: defensive | phase: n/a | mitre: none | Detecting kubectl debug Activity via Audit Logs | Identifying ephemeral container injection and node debug pod creation through API server audit events
- https://kubernetes-security.cloud/topics/detecting-orphan-pod-masquerading-via-audit-logs | md: https://kubernetes-security.cloud/topics/detecting-orphan-pod-masquerading-via-audit-logs.md | category: defensive | phase: n/a | mitre: none | Detecting Orphan Pod Masquerading via Audit Logs | Identifying pods that mimic controller-managed naming patterns but were created directly by a user rather than a controller
- https://kubernetes-security.cloud/topics/detecting-permission-enumeration-audit | md: https://kubernetes-security.cloud/topics/detecting-permission-enumeration-audit.md | category: defensive | phase: n/a | mitre: none | Detecting Permission Enumeration via Audit Logs | Spotting enumeration of current RBAC access by auditing SelfSubjectRulesReview events
- https://kubernetes-security.cloud/topics/disable-automount-service-account-token | md: https://kubernetes-security.cloud/topics/disable-automount-service-account-token.md | category: defensive | phase: n/a | mitre: none | Disable Automatic Mounting of Default Service Account Tokens | Preventing token theft by controlling service account token mounting
- https://kubernetes-security.cloud/topics/enforcing-read-only-container-filesystems | md: https://kubernetes-security.cloud/topics/enforcing-read-only-container-filesystems.md | category: defensive | phase: n/a | mitre: none | Enforcing Read-Only Container Filesystems | Prevent attackers from writing tools, backdoors, or scripts to a container's filesystem after gaining code execution
- https://kubernetes-security.cloud/topics/gke-anonymous-reconnaissance | md: https://kubernetes-security.cloud/topics/gke-anonymous-reconnaissance.md | category: offensive | phase: reconnaissance | mitre: T1526, T1590, T1592, T1596, T1613 | GKE Anonymous Reconnaissance | Exposing GKE patch versions and cluster configuration to unauthenticated clients when anonymousAuthenticationConfig is ENABLED
- https://kubernetes-security.cloud/topics/hiding-service-from-enumeration | md: https://kubernetes-security.cloud/topics/hiding-service-from-enumeration.md | category: defensive | phase: n/a | mitre: none | Hiding Services from Enumeration | Preventing internal service discovery by disabling automatic injection of service environment variables
- https://kubernetes-security.cloud/topics/internal-cluster-discovery | md: https://kubernetes-security.cloud/topics/internal-cluster-discovery.md | category: offensive | phase: reconnaissance | mitre: T1046, T1613 | Internal Cluster Discovery | Techniques for discovering available services, APIs, and potential attack vectors within a Kubernetes cluster
- https://kubernetes-security.cloud/topics/kubernetes-impersonation | md: https://kubernetes-security.cloud/topics/kubernetes-impersonation.md | category: offensive | phase: privilege-escalation | mitre: T1078 | Kubernetes Impersonation | Abusing the impersonate verb and Impersonate-* headers so the API server authorizes requests as another user, group, or ServiceAccount
- https://kubernetes-security.cloud/topics/orphan-pod-masquerading | md: https://kubernetes-security.cloud/topics/orphan-pod-masquerading.md | category: offensive | phase: defense-evasion | mitre: T1036 | Orphan Pod Masquerading | Creating orphan pods that mimic controller-managed naming conventions to blend in with legitimate workloads
- https://kubernetes-security.cloud/topics/passive-secret-discovery-via-kube-state-metrics | md: https://kubernetes-security.cloud/topics/passive-secret-discovery-via-kube-state-metrics.md | category: offensive | phase: reconnaissance | mitre: T1046, T1613 | Passive Secret Discovery via kube-state-metrics | Passively discovering secret names, namespaces, and metadata cluster-wide by querying the unauthenticated kube-state-metrics endpoint
- https://kubernetes-security.cloud/topics/persistence-via-unbound-serviceaccount-tokens | md: https://kubernetes-security.cloud/topics/persistence-via-unbound-serviceaccount-tokens.md | category: offensive | phase: persistence | mitre: T1550.001, T1078, T1528 | Persistence via Unbound Service Account Tokens | Using unbound tokens from the TokenRequest API to maintain cluster access after deleting the attacking pod
- https://kubernetes-security.cloud/topics/privilege-escalation-via-serviceaccount-token-creation | md: https://kubernetes-security.cloud/topics/privilege-escalation-via-serviceaccount-token-creation.md | category: offensive | phase: privilege-escalation | mitre: T1528, T1550, T1078 | Privilege Escalation via serviceaccounts/token Permission | How create permission on the serviceaccounts/token subresource enables acquiring tokens for more privileged service accounts without pods or Secrets
- https://kubernetes-security.cloud/topics/restricting-prometheus-endpoint-access | md: https://kubernetes-security.cloud/topics/restricting-prometheus-endpoint-access.md | category: defensive | phase: n/a | mitre: none | Restricting Prometheus Endpoint Access | Preventing unauthenticated access to Prometheus metrics that expose cluster topology, pod identities, and internal service addresses
- https://kubernetes-security.cloud/topics/rogue-static-pod-deployment | md: https://kubernetes-security.cloud/topics/rogue-static-pod-deployment.md | category: offensive | phase: persistence | mitre: T1610, T1543.005, T1564 | Rogue Static Pod Deployment | Deploying static pod manifests that bypass API server admission to run containers invisible to kubectl and API-based monitoring
- https://kubernetes-security.cloud/topics/secret-exfiltration-via-applicationset-generators | md: https://kubernetes-security.cloud/topics/secret-exfiltration-via-applicationset-generators.md | category: offensive | phase: credential-access | mitre: T1552, T1567, T1606, T1046 | Secret Exfiltration via ApplicationSet Generators | Abusing tokenRef on a pullRequest generator to make the controller send a Secret from the argocd namespace to a URL you control
- https://kubernetes-security.cloud/topics/securing-argocd-application-access | md: https://kubernetes-security.cloud/topics/securing-argocd-application-access.md | category: defensive | phase: n/a | mitre: none | Securing ArgoCD Application Access | Restrict ArgoCD RBAC, enforce AppProject boundaries, and block privileged workload deployment through the ArgoCD confused deputy attack path
- https://kubernetes-security.cloud/topics/serviceaccount-token-theft | md: https://kubernetes-security.cloud/topics/serviceaccount-token-theft.md | category: offensive | phase: credential-access | mitre: T1552, T1078 | ServiceAccount Token Theft | Techniques for obtaining ServiceAccount tokens using legitimate Kubernetes features without exploiting vulnerabilities
- https://kubernetes-security.cloud/topics/weaponizing-argo-workflows | md: https://kubernetes-security.cloud/topics/weaponizing-argo-workflows.md | category: offensive | phase: privilege-escalation | mitre: T1610, T1059, T1078, T1036 | Weaponizing Argo Workflows | Abusing Argo Workflows API to execute arbitrary workloads for privilege escalation and persistence
- https://kubernetes-security.cloud/topics/weaponizing-argocd-application | md: https://kubernetes-security.cloud/topics/weaponizing-argocd-application.md | category: offensive | phase: privilege-escalation | mitre: T1610, T1059, T1036, T1611 | Weaponizing ArgoCD Application | Abusing ArgoCD as a confused deputy to deploy disguised privileged workloads cluster-wide and maintain persistent access
- https://kubernetes-security.cloud/topics/weaponizing-kubectl-debug | md: https://kubernetes-security.cloud/topics/weaponizing-kubectl-debug.md | category: offensive | phase: privilege-escalation | mitre: T1611, T1552, T1078, T1059 | Weaponizing kubectl debug | Why kubectl debug is a privilege escalation path, not just a troubleshooting tool
- https://kubernetes-security.cloud/topics/weaponizing-pod-creation | md: https://kubernetes-security.cloud/topics/weaponizing-pod-creation.md | category: offensive | phase: privilege-escalation | mitre: T1611, T1548 | Weaponizing Pod Creation Access | How pod creation permissions can be leveraged to escalate privileges and escape to the underlying node

## Glossary pages
- https://kubernetes-security.cloud/glossary/admission-controller | md: https://kubernetes-security.cloud/glossary/admission-controller.md | category: component | mitre: none | Admission Controller | A plugin that intercepts API server requests to validate or mutate resources before they are persisted
- https://kubernetes-security.cloud/glossary/api-server | md: https://kubernetes-security.cloud/glossary/api-server.md | category: component | mitre: none | API Server | The central management component that exposes the Kubernetes API
- https://kubernetes-security.cloud/glossary/clusterrole | md: https://kubernetes-security.cloud/glossary/clusterrole.md | category: resource | mitre: none | ClusterRole | A cluster-scoped RBAC object that defines permissions across all namespaces or for non-namespaced resources
- https://kubernetes-security.cloud/glossary/clusterrolebinding | md: https://kubernetes-security.cloud/glossary/clusterrolebinding.md | category: resource | mitre: none | ClusterRoleBinding | A cluster-scoped RBAC object that grants the permissions defined in a ClusterRole across the entire cluster
- https://kubernetes-security.cloud/glossary/configmap | md: https://kubernetes-security.cloud/glossary/configmap.md | category: resource | mitre: none | ConfigMap | A Kubernetes object used to store non-sensitive configuration data as key-value pairs
- https://kubernetes-security.cloud/glossary/container | md: https://kubernetes-security.cloud/glossary/container.md | category: component | mitre: none | Container | A lightweight, standalone executable unit that packages an application and its dependencies
- https://kubernetes-security.cloud/glossary/container-escape | md: https://kubernetes-security.cloud/glossary/container-escape.md | category: attack | mitre: T1610, T1055 | Container Escape | A security vulnerability where an attacker breaks out of a container to access the host system
- https://kubernetes-security.cloud/glossary/cronjob | md: https://kubernetes-security.cloud/glossary/cronjob.md | category: resource | mitre: none | CronJob | A Kubernetes controller that creates Jobs on a recurring schedule defined using cron syntax
- https://kubernetes-security.cloud/glossary/customresourcedefinition | md: https://kubernetes-security.cloud/glossary/customresourcedefinition.md | category: resource | mitre: none | CustomResourceDefinition | A way to extend Kubernetes by defining your own resource types
- https://kubernetes-security.cloud/glossary/daemonset | md: https://kubernetes-security.cloud/glossary/daemonset.md | category: resource | mitre: none | DaemonSet | Ensures a copy of a Pod runs on all or selected nodes in the cluster
- https://kubernetes-security.cloud/glossary/deployment | md: https://kubernetes-security.cloud/glossary/deployment.md | category: resource | mitre: none | Deployment | A controller that manages the desired state of Pods and ReplicaSets
- https://kubernetes-security.cloud/glossary/etcd | md: https://kubernetes-security.cloud/glossary/etcd.md | category: component | mitre: none | etcd | The distributed key-value store that holds all Kubernetes cluster state
- https://kubernetes-security.cloud/glossary/helm | md: https://kubernetes-security.cloud/glossary/helm.md | category: component | mitre: none | Helm | A package manager for Kubernetes that bundles resources into reusable, versioned charts
- https://kubernetes-security.cloud/glossary/ingress | md: https://kubernetes-security.cloud/glossary/ingress.md | category: resource | mitre: none | Ingress | Manages external HTTP/HTTPS access to services in the cluster
- https://kubernetes-security.cloud/glossary/job | md: https://kubernetes-security.cloud/glossary/job.md | category: resource | mitre: none | Job | A Kubernetes controller that runs one or more Pods to successful completion
- https://kubernetes-security.cloud/glossary/kube-proxy | md: https://kubernetes-security.cloud/glossary/kube-proxy.md | category: component | mitre: none | kube-proxy | A network proxy that runs on each node and maintains network rules for Services
- https://kubernetes-security.cloud/glossary/kubelet | md: https://kubernetes-security.cloud/glossary/kubelet.md | category: component | mitre: none | Kubelet | The agent running on each node that manages Pods and containers
- https://kubernetes-security.cloud/glossary/label-selector | md: https://kubernetes-security.cloud/glossary/label-selector.md | category: resource | mitre: none | Label and Selector | Key-value pairs attached to Kubernetes objects and the queries used to filter them
- https://kubernetes-security.cloud/glossary/namespace | md: https://kubernetes-security.cloud/glossary/namespace.md | category: resource | mitre: none | Namespace | A virtual cluster within Kubernetes used to isolate and organize resources
- https://kubernetes-security.cloud/glossary/network-policy | md: https://kubernetes-security.cloud/glossary/network-policy.md | category: resource | mitre: none | NetworkPolicy | A Kubernetes resource that controls traffic flow between pods and namespaces
- https://kubernetes-security.cloud/glossary/node | md: https://kubernetes-security.cloud/glossary/node.md | category: component | mitre: none | Node | A worker machine in Kubernetes that runs Pods and is managed by the control plane
- https://kubernetes-security.cloud/glossary/operator | md: https://kubernetes-security.cloud/glossary/operator.md | category: component | mitre: none | Operator | A pattern for extending Kubernetes with custom controllers that automate the management of complex applications
- https://kubernetes-security.cloud/glossary/persistentvolume | md: https://kubernetes-security.cloud/glossary/persistentvolume.md | category: resource | mitre: none | PersistentVolume | A piece of storage in the cluster that has been provisioned for use by Pods independently of their lifecycle
- https://kubernetes-security.cloud/glossary/pod | md: https://kubernetes-security.cloud/glossary/pod.md | category: resource | mitre: none | Pod | The smallest deployable unit in Kubernetes that can be created and managed
- https://kubernetes-security.cloud/glossary/rbac | md: https://kubernetes-security.cloud/glossary/rbac.md | category: security | mitre: none | RBAC (Role-Based Access Control) | A method of regulating access to computer or network resources based on the roles of individual users
- https://kubernetes-security.cloud/glossary/replicaset | md: https://kubernetes-security.cloud/glossary/replicaset.md | category: resource | mitre: none | ReplicaSet | A Kubernetes controller that ensures a specified number of Pod replicas are running at all times
- https://kubernetes-security.cloud/glossary/role | md: https://kubernetes-security.cloud/glossary/role.md | category: resource | mitre: none | Role | A namespace-scoped RBAC object that defines a set of permissions for resources within a single namespace
- https://kubernetes-security.cloud/glossary/rolebinding | md: https://kubernetes-security.cloud/glossary/rolebinding.md | category: resource | mitre: none | RoleBinding | A namespace-scoped RBAC object that grants the permissions defined in a Role to users, groups, or service accounts
- https://kubernetes-security.cloud/glossary/secret | md: https://kubernetes-security.cloud/glossary/secret.md | category: resource | mitre: none | Secret | A Kubernetes object used to store sensitive data such as passwords, tokens, and keys
- https://kubernetes-security.cloud/glossary/service | md: https://kubernetes-security.cloud/glossary/service.md | category: resource | mitre: none | Service | An abstraction that exposes a set of Pods as a network service
- https://kubernetes-security.cloud/glossary/serviceaccount | md: https://kubernetes-security.cloud/glossary/serviceaccount.md | category: resource | mitre: none | ServiceAccount | An identity for processes running inside Pods to authenticate with the API server
- https://kubernetes-security.cloud/glossary/statefulset | md: https://kubernetes-security.cloud/glossary/statefulset.md | category: resource | mitre: none | StatefulSet | A Kubernetes workload controller for managing stateful applications that require stable identities and persistent storage
- https://kubernetes-security.cloud/glossary/taint-toleration | md: https://kubernetes-security.cloud/glossary/taint-toleration.md | category: resource | mitre: none | Taint and Toleration | A mechanism to control which Pods can be scheduled onto specific nodes
- https://kubernetes-security.cloud/glossary/volume | md: https://kubernetes-security.cloud/glossary/volume.md | category: resource | mitre: none | Volume | A directory accessible to containers in a Pod, used to share data or persist state beyond a container's lifetime