Kubetier
T1Exec into a privileged pod

  1. Enumerate pods to find one running as root, privileged, or with a powerful SA

  2. Exec or attach into it

  3. Steal the mounted SA token, access the node, or move laterally

  4. If the pod sets shareProcessNamespace, the exec'd container sees every sibling container's processes and /proc, letting the attacker read another container's env vars and in-memory secrets

Rights needed, any one set:

K8s docs ↗