Kubernetes Penetration TestingTrace the pivot paths before someone else does.
SecureLayer7 testers abuse Kubernetes the way a motivated actor does after they already have a foothold: reachable kubelets, RBAC verbs that chain to cluster-admin, admission stacks that look fine on paper, and tokens that survive longer than the pod. You get ranked chains with manifests, kubectl transcripts, fixes written for platform engineers, and a re-test so audit sees proof, not debate.
Cluster-internal vantage
We start from workloads and identities your threat model already treats as risky, then move toward control plane and supply-chain edges. Not a perimeter-only review.
Working proof-of-exploit
Manifests, commands, and remediation your engineers can drop straight into tickets. Not a passing CIS row that still leaves cluster-admin within reach.
Re-test included
After you ship patches, we re-run the chain. Written confirmation for each closed pivot, at no extra fee.
The window from vulnerability discovery to exploitation has gone from weeks to hours.
Trusted by security teams across Fintech, SaaS & Education, Enterprise & Telecom, Security & Critical Infrastructure
On record
Why benchmarks greenwash risk
Clean CIS rows do not erase cluster-admin routes. Chained pivots do.
kube-bench, Trivy, and CIS profiles grade configuration snapshots. They rarely prove chained impact: compromised workload, abused kubelet API, lateral hops across namespaces, cluster-admin. We string those steps the way an adversary would, so platform leads and auditors get a narrative they can follow without guessing.
POD-ESCAPE PATHS.
Where a misconfigured cluster gives an attacker root on the host.
- 01hostPath to node root
Pod mounts / from the host, attacker writes to /etc/kubernetes/manifests, static-pod becomes a privileged kubelet workload.
- 02Privileged pod escape
securityContext.privileged true, capabilities SYS_ADMIN, mount cgroups release_agent, execute on the node as root.
- 03Service-account token theft
Auto-mounted token in a compromised pod, kubectl auth can-i wildcard, list secrets across every namespace.
- 04Kubeconfig from disk
Developer kubeconfig left in a CI runner image, cluster-admin context survives image rebuild, attacker reuses it from outside.
- 05etcd direct read
etcd endpoint exposed on the control-plane subnet without client-cert auth, dump every Secret object in plaintext.
- 06Admission webhook bypass
ValidatingAdmissionWebhook fail-open on timeout, attacker submits a Pod that the policy would have blocked.
- 07Ingress mTLS gap
Internal service trusts the ingress identity, attacker who reaches the service mesh from a sidecar replays cluster-internal calls.
Scope ,
Four cluster planes. One engagement.
Most cluster reviews stop at isolated findings. We chain control plane exposure, workload breakout, identity and secrets, and supply-chain trust in one engagement, mapped to your topology and exercised manually against the bug classes that appear once an attacker already has a foothold.
Control plane
kube-apiserver anonymous-auth, etcd 2379 exposure, kubelet 10250 unauth, scheduler / controller-manager metrics leak, admission-webhook race, audit-policy gap, /healthz info disclosure, in-cluster API server SSRF.
Workload & data plane
Privileged-container escape, hostPath / hostNetwork / hostPID abuse, SYS_ADMIN & NET_RAW capability misuse, missing seccomp / AppArmor, PodSecurityStandards bypass, NetworkPolicy default-allow, sidecar trust-boundary leak, ConfigMap secrets leak.
Identity, RBAC & secrets
ServiceAccount token theft and replay, escalate / impersonate / bind verb chaining, over-scoped ClusterRoleBinding, projected-token reuse across namespaces, IRSA / Workload-Identity confusion, External-Secrets misconfig, kubectl auth can-i blind spots.
Supply chain
Mutating-webhook abuse, unsigned-image admission, ImagePullSecret leak, base-image typosquat, SBOM tampering, GitOps repo and pipeline takeover, Helm-chart values injection, registry-credential reuse across clusters.
KUBERNETES METHODOLOGY.
Eight phases. Threat-modelled to your cluster.
Scoped to your topology, namespaces, RBAC graph, admission controllers, and how images actually ship. We stress APIs, controllers, workloads, and pipelines until impact is demonstrated or ruled out. Deliverables include prerequisites, blast radius, and remediation sized for how your platform team ships change.
- 01Scope & threat-model
- 02Recon & enumeration
- 03Configuration review
- 04Identity & RBAC exploitation
- 05Workload & cluster exploitation
- 06Supply chain & admission
- 07Remediation guidance
- 08Patch verification
Insights
Kubernetes security Resources.
Notes from operators who publish CVE research and ship fixes in the open: Kubernetes hardening, exploit chains, and lessons from real cluster engagements.
Meet our engagement lead
Engagement lead. John Dill.
John Dill
vCISO at SecureLayer7
15+
Years in offensive security
150+
Engagements led to date
99.99%
On-time engagement delivery
John owns Kubernetes engagements from scope to re-test. Topology and RBAC graph become the test plan your platform org recognises. He stays through live walkthroughs, remediation, and re-test.
- Scopes EKS, AKS, GKE, and self-managed clusters against how you run production, not a generic checklist.
- Runs kick-off, mid-engagement reviews, and live demos for every material finding.
- Closes the loop on remediation and re-test until pivot paths are demonstrably gone.
When your next board or audit cycle asks how far someone moves from one bad pod, book 30 minutes with John. Topology, RBAC graph, and timeline on one call.
Book a 30-min callTested by industry.
The bug classes named below come from real engagements in each sector. Pick the closest fit.
FinTech
Banking workloads on k8s, secret-rotation, PCI segmentation in service mesh.
HealthTech
HIPAA-aligned k8s workloads, PHI-handling pods, audit-log retention paths.
Built for Saudi Arabia engagements
What changes when we deliver here.
Compliance scoping
NCA CCC container rows cited per Kubernetes finding
Regulatory framework
SAMA D3 build-pipeline wording in deliverables
Local engagements
Riyadh telco closed 9 admission-controller gaps in one sprint
Local pricing
SAR per-cluster scoping with VAT 15% itemised
Compliance scoping
kubeconfig credentials rotated at engagement close
Kubernetes pentest questions from KSA platform teams.
Do findings hit NCA CCC container expectations?
Yes. RBAC, network policy, and runtime gaps are cited under CCC container rows. The CISO reads the cluster posture in one page.
Is the report shaped for SAMA D3 software lifecycle?
Yes. Build pipelines, image signing, and admission policy are written into SAMA D3 wording. Bank platform owners sign off in one pass.
Does the test stay inside KSA clusters?
Yes. We connect to KSA-region clusters only. kubeconfig credentials never leave the Kingdom and are rotated at close.
Are Pod Security Standards covered?
Yes. PSS baseline and restricted profiles are inspected per namespace. Each gap is mapped to the CCC control row that applies.
Delivery in Saudi Arabia
Kubernetes pentest for NCA CCC and SAMA D3.
Cluster RBAC, Pod Security, and admission controller findings cite NCA CCC container controls and SAMA D3 software lifecycle. KSA-region clusters only.
- Direct line
- +966-11-000-0000
- Office
- Riyadh, Saudi Arabia
Frameworks scoped: NCA ECC · SAMA CSF · PDPL · ISO/IEC 27001.
Sample engagement report
See a manifest-led kill chain auditors can follow.
The sample pack walks YAML-shaped edges, RBAC escalation, and the shortest path from workload compromise to cluster-wide impact. Redacted from real engagements, formatted for risk and audit readers. Sent after a short scoping call so examples match your environment.