CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

Network-Based Attack Vectors

The pod network is flat and cluster DNS is open to everyone in it, so lateral movement needs no exploit - a name and a port are enough. This guide moves between two namespaces with curl, then closes the path with the four lines of YAML that KCSA expects you to recognise.

Kubernetes Threat Model Guide 27 of 42 Intermediate

NetworkPolicy is enforced by the CNI. This cluster runs Cilium 1.18.1, so an ingress deny shows up as a timeout rather than a refusal - a policy on a cluster whose CNI ignores NetworkPolicy would change nothing at all.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this when you have to explain why lateral movement is so cheap in a default cluster. This matters because the pod network is flat and cluster DNS answers everybody - so an attacker never has to scan for anything.

Before you start

  1. A victim service, and an attacker somewhere else entirely

  2. DNS hands over the address, so nothing has to be scanned

  3. And the flat network carries the packet

  4. One NetworkPolicy, and the same request stops

Official sources

← All KCSA guides