Kubectl usage for pentesters

kubectl is a command line interface for running commands against Kubernetes clusters. kubectl is pronounced as cube c t l. Watch this talk for The definitive pronunciation guide :)

We have already added it to the attacker VM already shared with you.

  • Getting the kubernetes cluster information
kubectl cluster-info

  • Get information from nodes, pods, svc(services), ing(ingress), ns(namespace), deploy(deployments)
kubectl get nodes
kubectl get pods

kubectl get services

Bunch of these commands can use shortcuts. For example the rest of the commands are using their shortcuts.

kubectl get svc
kubectl get ing
kubectl get ns
kubectl get deploy

  • Getting more information
kubectl get nodes -o wide
kubectl get pods -o wide
kubectl get svc -o wide
kubectl get deploy -o wide

  • Getting detailed information
kubectl describe node <NODENAME>
kubectl describe pod <PODNAME>
kubectl describe svc <SVCNAME>
kubectl describe ing <SVCNAME>
kubectl describe ns <SVCNAME>
kubectl describe deploy <DEPLOYNAME>

  • Detailed help for the sub command
kubectl explain pod

  • Creating deployment using command line
kubectl run nginxdeployment --image=nginx:alpine
  • Port forward the pod to local system
kubectl port-forward <PODNAME> 1234:80

  • Deleting pod
kubectl delete pod <PODNAME>
kubectl delete deploy <DEPLOYNAME>
kubectl delete svc <SVCNAME>
kubectl delete ing <INGNAME>
kubectl delete ns <NSNAME>

  • Shell into the pod
kubectl exec -it <PODNAME> sh

  • Looking for logs (stdout & stderr)
kubectl logs <PODNAME>
kubectl logs -f <PODNAME>

  • Combining multiple commands
kubectl get pods,svc

  • Specifying with different namepsace
kubectl get pods -n database

  • Listing the API resources avialble
kubectl api-resources
  • Checking for the permission to do
kubectl auth can-i create pods

  • Getting output in YAML format
kubectl get secrets <SECRETNAME> -o yaml

References