Kubernetes for the SOC I

If you’re overwhelmed by cloud alerts and unsure how to protect your environment in defense and security operations, this living guide is for you. We’ll call this part one of the guide, where we explore the rise of Kubernetes, its history and fundamentals, potential attack vectors, and how to gather the evidence we need to support our investigation.

From one SOC child to another,

I. The Rise of Kubernetes

Cloud environments are becoming more difficult to defend because the cloud itself is an abstraction.

This does not mean on-premises environments like Active Directory lack abstractions. We know legacy components work because they just do, and that feels like an abstraction too.

In this instance, we now have to learn an entirely new environment where everything isn't one-to-one.

We’ll focus on understanding one increasingly popular orchestration platform used for containerized applications, Kubernetes, and how it affects the cyber landscape (by extending it).

Here are some facts that you should know:

• Based on the Linux Foundation’s survey, “production usage of Kubernetes now stands at 82% among container users”.

• According to Palo Alto Networks, “Kubernetes-related threat actor operations, including stealing Kubernetes tokens, increased 282% over the last year.”

• Container orchestration isn't new; Google employees who developed and supported Borg (Google’s own container orchestration platform back in 2015) contributed their knowledge to Kubernetes.

II. Kubernetes History & Fundamentals

According to Kubernetes official documentation, “Kubernetes, also known as K8S, is an open source system for automating deployment, scaling, and management of containerized applications.”’

What does that actually mean?

What you need to know as a security analyst is that:

• Various legacy architectures could be described as a “monolith“ but cloud-native technologies have made it possible to widely adopt microservice-based architectures.

• Microservices support modern application architecture by providing a collection of dedicated services to support the application overall.

• Imagine a service dedicated to a single purpose (ex., a service for handling a user’s checkout, one for verifying a user’s credit card, and another for checking website traffic).

• By tying small pieces, or “microservices,” together to build your system, we gain benefits like reliability (if one service fails, the system can keep running).

Side Note: I am not a developer, so there are caveats to using microservice-based architecture; this article is not in-depth enough to cover all complexities.

• Kubernetes comes into the picture by orchestrating or managing the resources (such as containers) that support the application; tasks could include ensuring containers are deployed, fixing failures that arise, and scaling resources such as memory (up or down) to support them (there is far more it can do).

• You will hear terms like control plane, pod, container, and cluster often. Start learning them now.

To further visualize the architecture:

III. Kubernetes Attack Vectors

Threat actors can enter the environment in several ways, and I won’t bore you by repeating all of them — we’ll likely cover those in a follow-up article.

What you should know is that misconfigurations will likely be the bane of your existence.

Most technology products are built with usability and productivity in mind, not security. For example, Kubernetes was first announced on June 6th, 2014. The kubelet exploit was discussed a year later. Then, on August 26th, 2016, the kubelet-exploit was made public. With this exploit, anyone with network access to the kubelet service “could automatically gain command execution without authentication” (Rory McCune), which could result in secret exposure and cluster compromise.

And ten years later, this has long since been resolved, but I mentioned this scenario to show you what we are working with. Misconfigurations or configuration weaknesses will often be your focus as a security analyst.

Control Plane

• The control plane is the brain of Kubernetes. To interact with the control plane, we use an exposed interface: the API server, which uses HTTP and REST to perform operations on resources in the cluster. However, the API server is not the only component in the control plane. The control plane controls the workload. Worker nodes execute said workload.

• Attack Example: If you can gain access to the Kubernetes API with the right permissions (let’s say cluster admin), you could perform administrative actions such as deploying your own workloads.

Kubernetes API Server

• Attack Example: In 2024, a Cryptojacking campaign targeted “externally accessible Kubernetes API servers with anonymous authentication enabled”. Based on Kubernetes documentation, anonymous requests are enabled by default if no other authentication method is configured. So in a secure environment, you'd expect proper authentication to be set up.

Clusters

• “A Kubernetes cluster consists of a control plane plus a set of worker machines, called nodes, that run containerized applications” (Kubernetes documentation).

  • Attack Example: Redlock, a cybersecurity company, discovered an exposed Kubernetes administrative console at Tesla with no password (which would allow someone to gain control of the cluster) that unidentified hackers breached to mine cryptocurrency using software called Stratum. It is also unclear how long the hackers had access. The researchers received a total reward of $3,133.70 for their discovery.

Pod

• A pod is the smallest building block in Kubernetes and is a group of containers. Containers in a pod share resources such as storage and network configurations.

Containers

• Containers provide libraries or tools the application needs. Containers are created or “instantiated” from a blueprint called a “container image”. Containers are also not virtual machines.

• Now, based on what we’ve learned previously, you might already be thinking: what if a vulnerable library or tool is part of this container? Containers are deployed across your environment, making them a key focus.

  • Attack Example: Walking away with a $60,000 award at Pwn2Own Berlin 2025, Billy and Ramdhan of STAR Labs performed a Docker container escape that reached the underlying OS.  

• Exposed Kubernetes Secrets

• Insecure Network Policies

• RBAC / Role-based Access

IV. Monitoring Your Environment

There are three obstacles you’ll likely face when looking at your environment.

1. Lack of visibility due to logs.

2. Cloud infrastructure is ephemeral. Resources are spun up and torn down all the time.

3. Visualizing an attacker’s way of getting into an environment..

Exploring CSPM

Cloud Security Posture Management (CSPM) evolved from its predecessor: Cloud Infrastructure Security Posture Assessments (CISPA). One of CSPM's core functions is identifying misconfigurations.

There are several enterprise options available: Wiz, Defender for Cloud, CrowdStrike Falcon Cloud Security, and more.

If you want to explore a CSPM for your homelab, open-source options include Cloudsploit (though I haven't tested it yet, it’s still something you can check out as an analyst).

MITRE ATT&CK Matrix for Kubernetes

If you work in security operations, you are likely already familiar with the MITRE ATT&CK framework, which maps the phases of a typical attack through tactics and techniques.  

See the MITRE framework for Kubernetes posted in 2021 by the Cloud Native Computing Foundation.

Exploring Kubernetes Events using KQL

Several cloud services deploy Kubernetes, such as Google’s GKE, Amazon Elastic Kubernetes Service (EKS), and Azure’s Kubernetes Service (AKS).

Microsoft provides documentation on exploring different KQL tables to look over Kubernetes-related events. One table of interest (although not included in the basic log plan) is KubeEvents, which stores Kubernetes events.

Sources:

Hohn, Alan. The Book of Kubernetes: A Complete Guide to Container Orchestration. No Starch Press, 2022.

Linux Foundation. "Introduction to Kubernetes." Linux Foundation Training, 2023. https://training.linuxfoundation.org/training/introduction-to-kubernetes/

Cloud Security Engineer Roadmap by PWNED Labs

Fadilpašić, Sead. "Kubernetes security report finds people have no idea how to use Kubernetes." TechRadar, July 29, 2022. https://www.techradar.com/pro/kubernetes-security-report-finds-people-have-no-idea-how-to-use-kubernetes

McCune, Rory. "Charting the Course: The History and Evolution of Kubernetes Security." YouTube, 2023. https://www.youtube.com/watch?v=F7Y5gR5Qp7M

Hackett, Robert. "Tesla Hackers Hijacked Amazon Cloud Account to Mine Cryptocurrency." Fortune, February 20, 2018. https://fortune.com/2018/02/20/tesla-amazon-cloud-hack-cryptocurrency/