get pods/proxy
The API server proxy reaches any HTTP endpoint inside a pod without direct network access.
Internal admin endpoints, debug handlers, and metrics become accessible this way, bypassing NetworkPolicies.
Forging a pod's status.podIP does not redirect this proxy, because pods/proxy resolves the pod's real address through the kubelet and never consults status.podIP.
Contextual upgrade to T0:
T0 where a reachable pod runs as a cluster-privileged ServiceAccount and exposes an endpoint that returns its mounted token or performs token-issuing actions.
The proxy speaks to the pod as the API server, so any unauthenticated debug or admin surface inside the container is reachable without a shell.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Proxy an HTTP request through the API server to a known Pod name and port
Reach an internal admin, debug, metrics, or application endpoint not exposed externally.
NetworkPolicies do not apply to API-server-proxied traffic
Extract credentials or invoke privileged application actions via the unauthenticated internal endpoint
Additional rights needed:
Note:
This reaches T0 when the Pod runs as a high-privilege SA and exposes a debug endpoint that returns its mounted token or allows token-issuing actions.