Kubernetes Penetration TestingTrace the pivot paths before someone else does.
SecureLayer7 testers abuse Kubernetes the way a motivated actor does after they already have a foothold: reachable kubelets, RBAC verbs that chain to cluster-admin, admission stacks that look fine on paper, and tokens that survive longer than the pod. You get ranked chains with manifests, kubectl transcripts, fixes written for platform engineers, and a re-test so audit sees proof, not debate.
Cluster-internal vantage
We start from workloads and identities your threat model already treats as risky, then move toward control plane and supply-chain edges. Not a perimeter-only review.
Working proof-of-exploit
Manifests, commands, and remediation your engineers can drop straight into tickets. Not a passing CIS row that still leaves cluster-admin within reach.
Re-test included
After you ship patches, we re-run the chain. Written confirmation for each closed pivot, at no extra fee.
The window from vulnerability discovery to exploitation has gone from weeks to hours.
Trusted by security teams across Fintech, SaaS & Education, Enterprise & Telecom, Security & Critical Infrastructure
On record
Why benchmarks greenwash risk
Clean CIS rows do not erase cluster-admin routes. Chained pivots do.
kube-bench, Trivy, and CIS profiles grade configuration snapshots. They rarely prove chained impact: compromised workload, abused kubelet API, lateral hops across namespaces, cluster-admin. We string those steps the way an adversary would, so platform leads and auditors get a narrative they can follow without guessing.
POD-ESCAPE PATHS.
Where a misconfigured cluster gives an attacker root on the host.
- 01hostPath to node root
Pod mounts / from the host, attacker writes to /etc/kubernetes/manifests, static-pod becomes a privileged kubelet workload.
- 02Privileged pod escape
securityContext.privileged true, capabilities SYS_ADMIN, mount cgroups release_agent, execute on the node as root.
- 03Service-account token theft
Auto-mounted token in a compromised pod, kubectl auth can-i wildcard, list secrets across every namespace.
- 04Kubeconfig from disk
Developer kubeconfig left in a CI runner image, cluster-admin context survives image rebuild, attacker reuses it from outside.
- 05etcd direct read
etcd endpoint exposed on the control-plane subnet without client-cert auth, dump every Secret object in plaintext.
- 06Admission webhook bypass
ValidatingAdmissionWebhook fail-open on timeout, attacker submits a Pod that the policy would have blocked.
- 07Ingress mTLS gap
Internal service trusts the ingress identity, attacker who reaches the service mesh from a sidecar replays cluster-internal calls.
Scope ,
Four cluster planes. One engagement.
Most cluster reviews stop at isolated findings. We chain control plane exposure, workload breakout, identity and secrets, and supply-chain trust in one engagement, mapped to your topology and exercised manually against the bug classes that appear once an attacker already has a foothold.
Control plane
kube-apiserver anonymous-auth, etcd 2379 exposure, kubelet 10250 unauth, scheduler / controller-manager metrics leak, admission-webhook race, audit-policy gap, /healthz info disclosure, in-cluster API server SSRF.
Workload & data plane
Privileged-container escape, hostPath / hostNetwork / hostPID abuse, SYS_ADMIN & NET_RAW capability misuse, missing seccomp / AppArmor, PodSecurityStandards bypass, NetworkPolicy default-allow, sidecar trust-boundary leak, ConfigMap secrets leak.
Identity, RBAC & secrets
ServiceAccount token theft and replay, escalate / impersonate / bind verb chaining, over-scoped ClusterRoleBinding, projected-token reuse across namespaces, IRSA / Workload-Identity confusion, External-Secrets misconfig, kubectl auth can-i blind spots.
Supply chain
Mutating-webhook abuse, unsigned-image admission, ImagePullSecret leak, base-image typosquat, SBOM tampering, GitOps repo and pipeline takeover, Helm-chart values injection, registry-credential reuse across clusters.
KUBERNETES METHODOLOGY.
Eight phases. Threat-modelled to your cluster.
Scoped to your topology, namespaces, RBAC graph, admission controllers, and how images actually ship. We stress APIs, controllers, workloads, and pipelines until impact is demonstrated or ruled out. Deliverables include prerequisites, blast radius, and remediation sized for how your platform team ships change.
- 01Scope & threat-model
- 02Recon & enumeration
- 03Configuration review
- 04Identity & RBAC exploitation
- 05Workload & cluster exploitation
- 06Supply chain & admission
- 07Remediation guidance
- 08Patch verification
Insights
Kubernetes security Resources.
Notes from operators who publish CVE research and ship fixes in the open: Kubernetes hardening, exploit chains, and lessons from real cluster engagements.
Meet our engagement lead
Engagement lead. John Dill.
John Dill
vCISO at SecureLayer7
15+
Years in offensive security
150+
Engagements led to date
99.99%
On-time engagement delivery
John owns Kubernetes engagements from scope to re-test. Topology and RBAC graph become the test plan your platform org recognises. He stays through live walkthroughs, remediation, and re-test.
- Scopes EKS, AKS, GKE, and self-managed clusters against how you run production, not a generic checklist.
- Runs kick-off, mid-engagement reviews, and live demos for every material finding.
- Closes the loop on remediation and re-test until pivot paths are demonstrably gone.
When your next board or audit cycle asks how far someone moves from one bad pod, book 30 minutes with John. Topology, RBAC graph, and timeline on one call.
Book a 30-min callTested by industry.
The bug classes named below come from real engagements in each sector. Pick the closest fit.
FinTech
Banking workloads on k8s, secret-rotation, PCI segmentation in service mesh.
HealthTech
HIPAA-aligned k8s workloads, PHI-handling pods, audit-log retention paths.
Built for Australia engagements
What changes when we deliver here.
Regulatory framework
ACSC container security guidance map
Compliance scoping
PSS Restricted / Baseline score per namespace
Local engagements
Logistics SaaS — 14 clusters, 220+ namespaces
Local pricing
AUD per-cluster scoping, GST inclusive option
Compliance scoping
Essential 8 Strategy 1 + 2 evidence pack
Questions Australian platform engineers ask first.
Do you test Pod Security Standards?
Yes. Restricted, Baseline, and Privileged profile gaps are scored per namespace. Each gap cites the PSS rule and the ACSC container guidance section.
How do you handle admission controllers?
OPA / Gatekeeper and Kyverno policies are reviewed for ASD ISM separation of duties and least-privilege. Missing controls are graded as policy gaps.
What about workload identity to cloud APIs?
IRSA, Workload Identity, and Azure Workload Identity trust chains are tested. Cross-cloud federation is flagged for APP 8 disclosure.
Can findings feed an Essential 8 ML2 attestation?
Yes. Application control (Strategy 1) and patching (Strategy 2) evidence covers image scanning and node patching cadence.
Delivery in Australia
ACSC containers. ASD ISM workload.
Cluster, pod, and supply-chain findings cite ACSC container security guidance. Runtime gaps map to ASD ISM application control and software development clauses.
- Direct line
- +61-2-0000-0000
- Office
- Sydney, Australia
Frameworks scoped: ASD Essential 8 · APRA CPS 234 · Privacy Act · ISO/IEC 27001.
Sample engagement report
See a manifest-led kill chain auditors can follow.
The sample pack walks YAML-shaped edges, RBAC escalation, and the shortest path from workload compromise to cluster-wide impact. Redacted from real engagements, formatted for risk and audit readers. Sent after a short scoping call so examples match your environment.