A pod ships with everything needed to start enumerating: a service-account token, in-cluster DNS, and network reach to the API server and its neighbors. The first job is to learn who you are (what the token can do) and what is around you, before escalating.
Subtopics#
- In-pod enumeration: what the pod itself reveals.
- Service account and token discovery: find tokens and test them.
- API server enumeration: probe the API with your identity.
- Service and network discovery: map services and the pod network.
- Cloud metadata from pod: reach the node or workload cloud identity.