Kubernetes clusters install and manage software through tooling that runs with high privilege: Helm renders charts into cluster objects, and operators watch custom resources and reconcile them into workloads. Both consume definitions, charts, manifests, and images, that an attacker may be able to influence, and both act with the installer's or operator's permissions rather than the submitter's. A tampered chart or a malicious custom resource therefore executes attacker-defined objects at elevated privilege, making the provisioning layer an execution and persistence surface distinct from direct API abuse.
helm list -A 2>/dev/null # installed releases
kubectl get crd 2>/dev/null | head # operators' custom resources
kubectl get pods -A | grep -iE 'operator|controller' # operator controllers and their SAs
Subtopics#
- Helm chart abuse: malicious or tampered charts executing at install time.
- Operator and CRD abuse: driving an operator through its custom resources.