Lesson 02 — Kubernetes Reconnaissance

Welcome

Reconnaissance is the first technical phase of every penetration test.

Before attempting to exploit a Kubernetes environment, security professionals spend time understanding how the cluster is built, identifying exposed components, discovering available resources, and mapping the attack surface.

Successful attackers rarely begin with exploitation—they begin by collecting information.

As a Cloud Penetration Tester, your goal during reconnaissance is to gather as much information as possible while minimizing your footprint and avoiding unnecessary disruption to the target environment.

In this lesson, you will learn how to perform Kubernetes reconnaissance using the same methodology followed by enterprise security consultants.

Learning Objectives

After completing this lesson, you will be able to:

Understand the goals of Kubernetes reconnaissance.
Identify Kubernetes attack surfaces.
Discover exposed Kubernetes services.
Enumerate cluster resources.
Identify high-value assets.
Map the Kubernetes architecture.
Prepare for enterprise Kubernetes penetration testing.

Business Scenario

CloudNova Technologies has been authorized to perform a security assessment of a customer’s Kubernetes environment.

The customer has provided limited documentation about the cluster architecture. Before conducting any security testing, your team must identify the cluster components, exposed services, workloads, namespaces, and security controls.

Your objective is to gather information without making changes to the environment, enabling you to build a clear understanding of the Kubernetes deployment.

What is Kubernetes Reconnaissance?

Kubernetes reconnaissance is the process of collecting information about a Kubernetes environment before performing security testing.

The purpose is to answer questions such as:

What Kubernetes clusters exist?
Which services are exposed?
Which workloads are running?
What namespaces exist?
Which identities have access?
Where are the critical applications located?
What security controls are enabled?

The more complete your understanding of the environment, the more effective your assessment will be.

Reconnaissance Objectives

During reconnaissance, security consultants aim to identify:

Cluster architecture
Control Plane components
Worker Nodes
Namespaces
Pods
Services
Deployments
StatefulSets
DaemonSets
Ingress Controllers
Network Policies
Service Accounts
Secrets
ConfigMaps
Storage resources

Kubernetes Reconnaissance Workflow

Understand Environment

↓

Identify Cluster

↓

Discover API Server

↓

Enumerate Namespaces

↓

Identify Workloads

↓

Review Services

↓

Identify Identities

↓

Review Networking

↓

Identify High-Value Targets

↓

Prepare Assessment Plan

Internal Reconnaissance

When authenticated to a Kubernetes cluster, begin by identifying available resources.

Review:

Cluster information
Kubernetes version
API Server
Nodes
Namespaces
Pods
Services
Deployments
ReplicaSets
DaemonSets
StatefulSets

Document everything discovered.

External Reconnaissance

Before accessing the cluster, review publicly exposed components.

Identify:

Public Load Balancers
Ingress Controllers
Public APIs
DNS Records
External IP Addresses
Internet-facing applications

Determine which resources are accessible from outside the organization.

Namespace Enumeration

Namespaces divide Kubernetes resources into logical groups.

Review:

Default Namespace
kube-system
kube-public
Development
Testing
Production

Identify:

Business applications
Administrative workloads
Monitoring tools
CI/CD pipelines

Workload Enumeration

Review deployed workloads.

Identify:

Deployments
StatefulSets
DaemonSets
Jobs
CronJobs

Document:

Application Name
Namespace
Container Images
Replicas
Labels
Annotations

Service Enumeration

Review Kubernetes Services.

Identify:

ClusterIP
NodePort
LoadBalancer
ExternalName

Determine:

Which services are exposed
Internal communication paths
Public-facing applications

Identity Enumeration

Review Kubernetes identities.

Assess:

Service Accounts
Roles
ClusterRoles
RoleBindings
ClusterRoleBindings

Determine which identities have administrative privileges.

Secret Discovery

Identify:

Kubernetes Secrets
Mounted credentials
Service Account Tokens
TLS Certificates
API Keys

Document where sensitive information is stored.

Network Reconnaissance

Review:

Pod Networking
Service Networking
Network Policies
DNS Configuration
Ingress Resources
Egress Controls

Determine whether workloads are properly isolated.

High-Value Targets

During reconnaissance, prioritize assets such as:

Kubernetes API Server
etcd
Control Plane Nodes
Worker Nodes
Privileged Pods
Cluster Administrators
Secrets
Service Accounts
CI/CD Pipelines
Production Applications

These resources often provide the greatest value during a security assessment.

Common Reconnaissance Findings

During enterprise engagements, consultants frequently discover:

Publicly exposed dashboards
Unused namespaces
Excessive Service Accounts
Overly permissive RBAC
Missing Network Policies
Exposed NodePorts
Outdated Kubernetes versions
Public Load Balancers
Misconfigured Ingress Controllers
Unused workloads

Reconnaissance Best Practices

Professional consultants should:

Obtain authorization before scanning.
Minimize operational impact.
Document every discovered resource.
Avoid making configuration changes during reconnaissance.
Record evidence using screenshots and notes.
Identify critical business applications early.
Build a complete inventory before testing.

Key Takeaways

Reconnaissance is the foundation of every Kubernetes penetration test.
Understanding the cluster architecture improves assessment accuracy.
Namespaces, workloads, services, identities, and networking should all be enumerated.
High-value assets should be identified before exploitation begins.
A well-executed reconnaissance phase reduces risk and improves the efficiency of subsequent testing.

Lesson Summary

In this lesson, you learned how to perform Kubernetes reconnaissance by identifying cluster components, discovering workloads, reviewing identities, assessing networking, and mapping the Kubernetes attack surface.

These reconnaissance techniques provide the information needed to conduct a structured and effective Kubernetes security assessment while following professional consulting methodologies.

What’s Next?

➡️ Lesson 03 — Cluster Enumeration

In the next lesson, you will learn how to enumerate Kubernetes clusters in greater depth, reviewing nodes, workloads, API resources, RBAC objects, and configuration details to identify potential security weaknesses before exploitation.