Kubernetes Audit Log Detections: 8 Rules We Tested
Eight detection rules for the Kubernetes audit log, written as jq filters and mapped to MITRE ATT&CK: exec and debug sessions, pods asking for host …
Tag
Kubernetes
Kubernetes Audit Policy: What to Log, at What Level
A Kubernetes audit policy decides which API requests kube-apiserver records and how much of each it keeps. The first matching rule wins, so one …
Kubernetes Service Account Tokens: Retire Legacy Secrets
Kubernetes Pods get short-lived, Pod-bound service account tokens from the TokenRequest API, but Secret-based tokens still never expire and stay valid …
Kubernetes Secrets Encryption at Rest: What It Protects
Kubernetes stores Secrets unencrypted in etcd unless you configure an EncryptionConfiguration. Turning it on protects etcd data, but not against …
Kubernetes RBAC Audit: 11 Permissions That Escalate Access
Some Kubernetes RBAC permissions look harmless but let the holder become someone more powerful: list on Secrets, create on Pods, get on nodes/proxy, …
Kubernetes NetworkPolicy Default Deny: A Safe Rollout
Kubernetes allows all pod traffic until a NetworkPolicy selects a pod. A default-deny policy flips that, but it also blocks DNS, needs allow rules on …
Kubernetes MutatingAdmissionPolicy: CEL Mutations with Apply Configuration or JSON Patch, and When a Webhook Is Still Needed
MutatingAdmissionPolicy lets the Kubernetes API server change incoming objects with CEL expressions instead of calling a webhook. This guide covers …