# kubernetes-security.cloud

> Kubernetes security reference: topics (lessons), glossary terms, and optional attack-path diagrams.

## Generated
- generatedAt: 2026-05-19T13:38:49.327Z

## LLM usage notes
- Prefer `topics.json` for structured topic metadata and filtering.
- For offensive techniques, filter `category=offensive` then group/order by `phase`.
- Use `/topics/<topic-slug>.md` when you need full markdown plus action checklist and commands.
- `phase` is the canonical offensive classification field.
- Glossary entries are HTML pages only (no raw `.md` mirror); fetch the page or use the sitemap.

## Important URLs
- Topics overview: https://kubernetes-security.cloud/topics
- Glossary overview: https://kubernetes-security.cloud/glossary
- Machine-readable topic index (JSON): https://kubernetes-security.cloud/topics.json
- Raw markdown topic endpoint pattern: https://kubernetes-security.cloud/topics/<topic-slug>.md
- Sitemap: https://kubernetes-security.cloud/sitemap-index.xml

## Topic totals
- Total topics: 31
- Offensive topics: 19
- Defensive topics: 12
- Fundamental topics: 0

## Offensive phase index
- credential-access: 2 topic(s)
- defense-evasion: 1 topic(s)
- exfiltration: 1 topic(s)
- lateral-movement: 1 topic(s)
- persistence: 2 topic(s)
- privilege-escalation: 7 topic(s)
- reconnaissance: 5 topic(s)

## Topic pages
- https://kubernetes-security.cloud/topics/abusing-kubernetes-api-server-proxy | markdown: https://kubernetes-security.cloud/topics/abusing-kubernetes-api-server-proxy.md | category: offensive | phase: lateral-movement | Abusing Kubernetes API Server Proxy | Bypassing network policies and accessing internal services through the Kubernetes API server proxy subresource
- https://kubernetes-security.cloud/topics/abusing-kyverno-mutatingpolicy | markdown: https://kubernetes-security.cloud/topics/abusing-kyverno-mutatingpolicy.md | category: offensive | phase: privilege-escalation | Abusing Kyverno MutatingPolicy | How MutatingPolicy access can be abused to change pods during admission in Kyverno
- https://kubernetes-security.cloud/topics/active-internal-network-reconnaissance | markdown: https://kubernetes-security.cloud/topics/active-internal-network-reconnaissance.md | category: offensive | phase: reconnaissance | Active Internal Network Reconnaissance | Scanning internal cluster IP ranges from a compromised pod to discover open ports on services, pods, and nodes
- https://kubernetes-security.cloud/topics/cluster-reconnaissance-via-prometheus | markdown: https://kubernetes-security.cloud/topics/cluster-reconnaissance-via-prometheus.md | category: offensive | phase: reconnaissance | Cluster Reconnaissance via Prometheus | Querying an unauthenticated Prometheus endpoint to map cluster topology without touching the Kubernetes API
- https://kubernetes-security.cloud/topics/compromising-etcd-via-pod-creation | markdown: https://kubernetes-security.cloud/topics/compromising-etcd-via-pod-creation.md | category: offensive | phase: credential-access | Compromising etcd via Pod Creation | Steal etcd TLS via pod hostPath on the control plane
- https://kubernetes-security.cloud/topics/data-exfiltration-via-kubernetes-events | markdown: https://kubernetes-security.cloud/topics/data-exfiltration-via-kubernetes-events.md | category: offensive | phase: exfiltration | Data Exfiltration via Kubernetes Events | How attackers can misuse Kubernetes Events to move data out after cluster compromise
- https://kubernetes-security.cloud/topics/detecting-api-server-proxy-abuse | markdown: https://kubernetes-security.cloud/topics/detecting-api-server-proxy-abuse.md | category: defensive | phase: n/a | Detecting API Server Proxy Abuse | Identifying abuse of the services/proxy and pods/proxy subresources to bypass network segmentation or use the API server as an open HTTP proxy
- https://kubernetes-security.cloud/topics/detecting-argo-workflows-abuse | markdown: https://kubernetes-security.cloud/topics/detecting-argo-workflows-abuse.md | category: defensive | phase: n/a | Detecting Argo Workflows Abuse via Audit Logs | Identifying unauthorized workflow creation, CronWorkflow persistence, and WorkflowTemplate poisoning by auditing argoproj.io resource events
- https://kubernetes-security.cloud/topics/detecting-data-exfiltration-via-events | markdown: https://kubernetes-security.cloud/topics/detecting-data-exfiltration-via-events.md | category: defensive | phase: n/a | Detecting Data Exfiltration via Kubernetes Events | Identifying abuse of the Kubernetes Events API to smuggle data out of a cluster through event message fields
- https://kubernetes-security.cloud/topics/detecting-impersonation-abuse | markdown: https://kubernetes-security.cloud/topics/detecting-impersonation-abuse.md | category: defensive | phase: n/a | Detecting Impersonation Abuse | Identifying impersonation abuse by inspecting the impersonatedUser audit field and reviewing which subjects hold the impersonate verb
- https://kubernetes-security.cloud/topics/detecting-kubectl-debug-activity-via-audit-logs | markdown: https://kubernetes-security.cloud/topics/detecting-kubectl-debug-activity-via-audit-logs.md | category: defensive | phase: n/a | Detecting kubectl debug Activity via Audit Logs | Identifying ephemeral container injection and node debug pod creation through API server audit events
- https://kubernetes-security.cloud/topics/detecting-orphan-pod-masquerading-via-audit-logs | markdown: https://kubernetes-security.cloud/topics/detecting-orphan-pod-masquerading-via-audit-logs.md | category: defensive | phase: n/a | Detecting Orphan Pod Masquerading via Audit Logs | Identifying pods that mimic controller-managed naming patterns but were created directly by a user rather than a controller
- https://kubernetes-security.cloud/topics/detecting-permission-enumeration-audit | markdown: https://kubernetes-security.cloud/topics/detecting-permission-enumeration-audit.md | category: defensive | phase: n/a | Detecting Permission Enumeration via Audit Logs | Spotting enumeration of current RBAC access by auditing SelfSubjectRulesReview events
- https://kubernetes-security.cloud/topics/disable-automount-service-account-token | markdown: https://kubernetes-security.cloud/topics/disable-automount-service-account-token.md | category: defensive | phase: n/a | Disable Automatic Mounting of Default Service Account Tokens | Preventing token theft by controlling service account token mounting
- https://kubernetes-security.cloud/topics/enforcing-read-only-container-filesystems | markdown: https://kubernetes-security.cloud/topics/enforcing-read-only-container-filesystems.md | category: defensive | phase: n/a | Enforcing Read-Only Container Filesystems | Prevent attackers from writing tools, backdoors, or scripts to a container's filesystem after gaining code execution
- https://kubernetes-security.cloud/topics/gke-anonymous-reconnaissance | markdown: https://kubernetes-security.cloud/topics/gke-anonymous-reconnaissance.md | category: offensive | phase: reconnaissance | GKE Anonymous Reconnaissance | Exposing GKE patch versions and cluster configuration to unauthenticated clients when anonymousAuthenticationConfig is ENABLED
- https://kubernetes-security.cloud/topics/hiding-service-from-enumeration | markdown: https://kubernetes-security.cloud/topics/hiding-service-from-enumeration.md | category: defensive | phase: n/a | Hiding Services from Enumeration | Preventing internal service discovery by disabling automatic injection of service environment variables
- https://kubernetes-security.cloud/topics/internal-cluster-discovery | markdown: https://kubernetes-security.cloud/topics/internal-cluster-discovery.md | category: offensive | phase: reconnaissance | Internal Cluster Discovery | Techniques for discovering available services, APIs, and potential attack vectors within a Kubernetes cluster
- https://kubernetes-security.cloud/topics/kubernetes-impersonation | markdown: https://kubernetes-security.cloud/topics/kubernetes-impersonation.md | category: offensive | phase: privilege-escalation | Kubernetes Impersonation | Abusing the impersonate verb and Impersonate-* headers so the API server authorizes requests as another user, group, or ServiceAccount
- https://kubernetes-security.cloud/topics/orphan-pod-masquerading | markdown: https://kubernetes-security.cloud/topics/orphan-pod-masquerading.md | category: offensive | phase: defense-evasion | Orphan Pod Masquerading | Creating orphan pods that mimic controller-managed naming conventions to blend in with legitimate workloads
- https://kubernetes-security.cloud/topics/passive-secret-discovery-via-kube-state-metrics | markdown: https://kubernetes-security.cloud/topics/passive-secret-discovery-via-kube-state-metrics.md | category: offensive | phase: reconnaissance | Passive Secret Discovery via kube-state-metrics | Passively discovering secret names, namespaces, and metadata cluster-wide by querying the unauthenticated kube-state-metrics endpoint
- https://kubernetes-security.cloud/topics/persistence-via-unbound-serviceaccount-tokens | markdown: https://kubernetes-security.cloud/topics/persistence-via-unbound-serviceaccount-tokens.md | category: offensive | phase: persistence | Persistence via Unbound Service Account Tokens | Using unbound tokens from the TokenRequest API to maintain cluster access after deleting the attacking pod
- https://kubernetes-security.cloud/topics/privilege-escalation-via-serviceaccount-token-creation | markdown: https://kubernetes-security.cloud/topics/privilege-escalation-via-serviceaccount-token-creation.md | category: offensive | phase: privilege-escalation | Privilege Escalation via serviceaccounts/token Permission | How create permission on the serviceaccounts/token subresource enables acquiring tokens for more privileged service accounts without pods or Secrets
- https://kubernetes-security.cloud/topics/restricting-prometheus-endpoint-access | markdown: https://kubernetes-security.cloud/topics/restricting-prometheus-endpoint-access.md | category: defensive | phase: n/a | Restricting Prometheus Endpoint Access | Preventing unauthenticated access to Prometheus metrics that expose cluster topology, pod identities, and internal service addresses
- https://kubernetes-security.cloud/topics/rogue-static-pod-deployment | markdown: https://kubernetes-security.cloud/topics/rogue-static-pod-deployment.md | category: offensive | phase: persistence | Rogue Static Pod Deployment | Deploying static pod manifests that bypass API server admission to run containers invisible to kubectl and API-based monitoring
- https://kubernetes-security.cloud/topics/securing-argocd-application-access | markdown: https://kubernetes-security.cloud/topics/securing-argocd-application-access.md | category: defensive | phase: n/a | Securing ArgoCD Application Access | Restrict ArgoCD RBAC, enforce AppProject boundaries, and block privileged workload deployment through the ArgoCD confused deputy attack path
- https://kubernetes-security.cloud/topics/serviceaccount-token-theft | markdown: https://kubernetes-security.cloud/topics/serviceaccount-token-theft.md | category: offensive | phase: credential-access | ServiceAccount Token Theft | Techniques for obtaining ServiceAccount tokens using legitimate Kubernetes features without exploiting vulnerabilities
- https://kubernetes-security.cloud/topics/weaponizing-argo-workflows | markdown: https://kubernetes-security.cloud/topics/weaponizing-argo-workflows.md | category: offensive | phase: privilege-escalation | Weaponizing Argo Workflows | Abusing Argo Workflows API to execute arbitrary workloads for privilege escalation and persistence
- https://kubernetes-security.cloud/topics/weaponizing-argocd-application | markdown: https://kubernetes-security.cloud/topics/weaponizing-argocd-application.md | category: offensive | phase: privilege-escalation | Weaponizing ArgoCD Application | Abusing ArgoCD as a confused deputy to deploy disguised privileged workloads cluster-wide and maintain persistent access
- https://kubernetes-security.cloud/topics/weaponizing-kubectl-debug | markdown: https://kubernetes-security.cloud/topics/weaponizing-kubectl-debug.md | category: offensive | phase: privilege-escalation | Weaponizing kubectl debug | Why kubectl debug is a privilege escalation path, not just a troubleshooting tool
- https://kubernetes-security.cloud/topics/weaponizing-pod-creation | markdown: https://kubernetes-security.cloud/topics/weaponizing-pod-creation.md | category: offensive | phase: privilege-escalation | Weaponizing Pod Creation Access | How pod creation permissions can be leveraged to escalate privileges and escape to the underlying node

## Glossary totals
- Total glossary entries: 34

## Glossary pages
- https://kubernetes-security.cloud/glossary/admission-controller | category: component | Admission Controller | A plugin that intercepts API server requests to validate or mutate resources before they are persisted
- https://kubernetes-security.cloud/glossary/api-server | category: component | API Server | The central management component that exposes the Kubernetes API
- https://kubernetes-security.cloud/glossary/clusterrole | category: resource | ClusterRole | A cluster-scoped RBAC object that defines permissions across all namespaces or for non-namespaced resources
- https://kubernetes-security.cloud/glossary/clusterrolebinding | category: resource | ClusterRoleBinding | A cluster-scoped RBAC object that grants the permissions defined in a ClusterRole across the entire cluster
- https://kubernetes-security.cloud/glossary/configmap | category: resource | ConfigMap | A Kubernetes object used to store non-sensitive configuration data as key-value pairs
- https://kubernetes-security.cloud/glossary/container | category: component | Container | A lightweight, standalone executable unit that packages an application and its dependencies
- https://kubernetes-security.cloud/glossary/container-escape | category: attack | Container Escape | A security vulnerability where an attacker breaks out of a container to access the host system
- https://kubernetes-security.cloud/glossary/cronjob | category: resource | CronJob | A Kubernetes controller that creates Jobs on a recurring schedule defined using cron syntax
- https://kubernetes-security.cloud/glossary/customresourcedefinition | category: resource | CustomResourceDefinition | A way to extend Kubernetes by defining your own resource types
- https://kubernetes-security.cloud/glossary/daemonset | category: resource | DaemonSet | Ensures a copy of a Pod runs on all or selected nodes in the cluster
- https://kubernetes-security.cloud/glossary/deployment | category: resource | Deployment | A controller that manages the desired state of Pods and ReplicaSets
- https://kubernetes-security.cloud/glossary/etcd | category: component | etcd | The distributed key-value store that holds all Kubernetes cluster state
- https://kubernetes-security.cloud/glossary/helm | category: component | Helm | A package manager for Kubernetes that bundles resources into reusable, versioned charts
- https://kubernetes-security.cloud/glossary/ingress | category: resource | Ingress | Manages external HTTP/HTTPS access to services in the cluster
- https://kubernetes-security.cloud/glossary/job | category: resource | Job | A Kubernetes controller that runs one or more Pods to successful completion
- https://kubernetes-security.cloud/glossary/kube-proxy | category: component | kube-proxy | A network proxy that runs on each node and maintains network rules for Services
- https://kubernetes-security.cloud/glossary/kubelet | category: component | Kubelet | The agent running on each node that manages Pods and containers
- https://kubernetes-security.cloud/glossary/label-selector | category: resource | Label and Selector | Key-value pairs attached to Kubernetes objects and the queries used to filter them
- https://kubernetes-security.cloud/glossary/namespace | category: resource | Namespace | A virtual cluster within Kubernetes used to isolate and organize resources
- https://kubernetes-security.cloud/glossary/network-policy | category: resource | NetworkPolicy | A Kubernetes resource that controls traffic flow between pods and namespaces
- https://kubernetes-security.cloud/glossary/node | category: component | Node | A worker machine in Kubernetes that runs Pods and is managed by the control plane
- https://kubernetes-security.cloud/glossary/operator | category: component | Operator | A pattern for extending Kubernetes with custom controllers that automate the management of complex applications
- https://kubernetes-security.cloud/glossary/persistentvolume | category: resource | PersistentVolume | A piece of storage in the cluster that has been provisioned for use by Pods independently of their lifecycle
- https://kubernetes-security.cloud/glossary/pod | category: resource | Pod | The smallest deployable unit in Kubernetes that can be created and managed
- https://kubernetes-security.cloud/glossary/rbac | category: security | RBAC (Role-Based Access Control) | A method of regulating access to computer or network resources based on the roles of individual users
- https://kubernetes-security.cloud/glossary/replicaset | category: resource | ReplicaSet | A Kubernetes controller that ensures a specified number of Pod replicas are running at all times
- https://kubernetes-security.cloud/glossary/role | category: resource | Role | A namespace-scoped RBAC object that defines a set of permissions for resources within a single namespace
- https://kubernetes-security.cloud/glossary/rolebinding | category: resource | RoleBinding | A namespace-scoped RBAC object that grants the permissions defined in a Role to users, groups, or service accounts
- https://kubernetes-security.cloud/glossary/secret | category: resource | Secret | A Kubernetes object used to store sensitive data such as passwords, tokens, and keys
- https://kubernetes-security.cloud/glossary/service | category: resource | Service | An abstraction that exposes a set of Pods as a network service
- https://kubernetes-security.cloud/glossary/serviceaccount | category: resource | ServiceAccount | An identity for processes running inside Pods to authenticate with the API server
- https://kubernetes-security.cloud/glossary/statefulset | category: resource | StatefulSet | A Kubernetes workload controller for managing stateful applications that require stable identities and persistent storage
- https://kubernetes-security.cloud/glossary/taint-toleration | category: resource | Taint and Toleration | A mechanism to control which Pods can be scheduled onto specific nodes
- https://kubernetes-security.cloud/glossary/volume | category: resource | Volume | A directory accessible to containers in a Pod, used to share data or persist state beyond a container's lifetime