Kubernetes Pentesting

This is a reference playbook for attacking Kubernetes clusters, covering API server enumeration, RBAC abuse, service account token escalation, etcd extraction, and Kubelet exploitation. It includes cloud-specific metadata attacks for EKS, GKE, and AKS. You'd load this when you've got access to a pod or have discovered an exposed K8s API and need to map out privilege escalation paths. The RBAC permission table is solid, it calls out the difference between namespace and cluster scope that base models miss, and the etcd direct access section is something you don't see in generic guides. Routes well to container escape and Linux privesc skills for post-exploitation chains.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill kubernetes-pentesting --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Kubernetes Pentesting — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Kubernetes attack techniques. Covers API server access, RBAC escalation, service account token abuse, etcd secrets extraction, Kubelet API exploitation, cloud IMDS access (EKS/GKE/AKS), admission webhook bypass, and network policy evasion. Base models miss the distinction between namespace-scoped and cluster-scoped RBAC, and overlook Kubelet's unauthenticated API.

0. RELATED ROUTING

Before going deep, consider loading:

container-escape-techniques for escaping from a compromised pod to the underlying node
linux-privilege-escalation once on a node for escalating to root
linux-lateral-movement for pivoting between nodes
linux-security-bypass when Pod Security Standards or seccomp profiles restrict your actions
ssrf-server-side-request-forgery when exploiting SSRF to reach the K8s API or cloud metadata