Kubernetes Attacks Series Part 2: Kubernetes Fundamentals & Essential Commands

Welcome back to episode two of the Attacking EKS Clusters series! Before diving into hands-on exploitation, understanding the underlying architecture and permission models of Kubernetes and Amazon EKS is essential. While demonstrated on EKS, these core concepts apply across any Kubernetes deployment, including on-premise clusters and other cloud providers. In this video, we break down core Kubernetes architecture—from the control plane (API server, scheduler, etcd, controller-manager) to worker nodes (kubelet, container runtimes, pods, and service accounts). We then dive into a critical security area: how pods communicate with other AWS services. We examine the three main permission models and their attack surfaces: Legacy Node Instance Profiles: Pods querying the IMDS endpoint (169.254.169.254) and inheriting underlying worker node IAM roles. IAM Roles for Service Accounts (IRSA): Mapping IAM roles directly to Service Accounts via OIDC. Amazon EKS Pod Identity: The modern approach using the EKS Pod Identity Agent DaemonSet and native API associations. We also cover fundamental enumeration commands (kubectl config, namespace scoping, kubectl auth can-i, and node/pod enumeration) to help you map your permissions effectively. 💻 Terraform Lab & Setup Commands: The entire deployment has been automated with Terraform to let you spin the lab up and tear it down cleanly. All configuration files and commands used in this video can be found on my GitHub: https://github.com/Ruatelo/EKS-config 🔗 Resources & References: Official Kubernetes Documentation & Command Reference: https://kubernetes.io/docs/reference/... AWS Documentation on EKS Pod Identity & IRSA: https://docs.aws.amazon.com/eks/lates... 🚨 DISCLAIMER: This video is strictly for educational purposes and ethical hacking. The techniques demonstrated are intended to help cloud security professionals, penetration testers, and system administrators understand and mitigate vulnerabilities within their own authorized environments. Never test these techniques on AWS or Kubernetes environments you do not own or have explicit permission to audit. If you found this breakdown helpful, please like, subscribe, and hit the notification bell so you don't miss the upcoming exploitation videos! #Kubernetes #AWS #EKS #CloudSecurity #Pentesting #EthicalHacking #K8sSecurity #InfoSec #RedTeam #EKSPodIdentity #Terraform