B3: Cloud, Containers & Kubernetes
Kubernetes Deep: RBAC, Service Accounts, etcd & Admission
Map cluster identity, workloads, secrets, network policy, admission controls, and control-plane data.
Kubernetes security is cluster identity plus workload configuration. The question is always: what can this pod's service account do, what secrets can it read, and what paths exist to the control plane or cloud identity?
| Area | What to inspect | Risk |
|---|---|---|
| RBAC | Roles, ClusterRoles, RoleBindings, ClusterRoleBindings | Overbroad verbs like create pods, exec, secrets read, or bind/escalate. |
| Service Accounts | Mounted tokens, cloud workload identity, namespace boundaries | Pod compromise becomes API access. |
| Secrets | K8s secrets, external secret stores, env vars | Credentials leak into workloads or logs. |
| etcd | Access controls, encryption at rest, network reachability | Cluster state and secrets exposure. |
| Admission | Pod Security, OPA/Gatekeeper/Kyverno | Unsafe workloads admitted by default. |