Kubernetes Cluster Attack.

An intrusion against a Kubernetes (K8s) cluster that abuses exposed APIs, weak RBAC, or vulnerable workloads to gain control of the control plane or worker nodes. It belongs to the Cloud Security category of cybersecurity.

An intrusion against a Kubernetes (K8s) cluster that abuses exposed APIs, weak RBAC, or vulnerable workloads to gain control of the control plane or worker nodes.

A Kubernetes cluster attack targets the API server, kubelet, etcd, or the workloads themselves to gain code execution, steal secrets, or take over the cluster. Common entry points include exposed kube-apiserver without authentication, exposed kubelet read-write ports, vulnerable admission webhooks, stolen service-account tokens, and overprivileged pods. From an initial foothold, attackers chase paths such as pod-to-node via hostPath or privileged containers, service-account token replay against the API, or abuse of cluster-admin role bindings. Defences include strong RBAC, OIDC-based authentication, network policies, runtime security (Falco, Tetragon), admission controllers like Kyverno or OPA Gatekeeper, and signed, minimal container images.

Defences for Kubernetes Cluster Attack typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: K8s cluster compromise, Kubernetes intrusion.