Skip to content
Do you want to pick up from where you left of?
Take me there
Interactive Visual Architecture

Kubernetes Threat Model & Attack Chains

An authoritative, interactive reference architecture and threat modeling engine for enterprise Kubernetes. Inspect trust boundaries, threat actors, threat objects, attack vectors, and production hardening policies with real-time deep-linking, multi-layer abstraction depth, traffic flow overlays, and production-tested YAML, Shell, Falco eBPF, and CIS compliance inspectors.

4
Diagram Sheets
L0–L3
Depth Levels
TA01–07
Threat Actors
TO01–32
Threat Objects
AV01–32
Attack Vectors
C01–30
Controls
P1–P6
Attack Chains
100%
Depth:
Priority:
STRIDE:
Flow:
Preset Views:
Sheet 1: 01 · Master Threat Register & Cluster Overview | L0: Boundary • Click any component to inspect • Drag to pan
Kubernetes Threat Model Diagram
ID Category Priority Level

Component Name

Overview & Context

Origin:
Motive:
STRIDE Category:

Associated Attack Vectors

    KubeDaily Architecture Engine
    Threat Model Reference Catalog

    Enterprise Architecture & Attack Vector Catalog

    This model applies STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) and the MITRE ATT&CK for Containers matrix across Kubernetes components. Click any card below to automatically switch sheets, focus the diagram viewport, and inspect production YAML policies, shell audit commands, Falco eBPF detection rules, and CIS compliance benchmarks.

    4 Diagram Sheets Architecture Guide

    Sheet 01 Core Topology

    Master Threat Register & Cluster Overview

    High-trust Control Plane envelope (kube-apiserver, etcd), Data Plane worker nodes (kubelet, containerd), 7 threat actors (TA01–07), and 32 threat objects (TO01–32).

    Sheet 02 Attack Scenarios

    Attack Chains & Mitigation Narratives

    Step-by-step kill chains spanning P1 (Ingress RCE), P2 (ServiceAccount Token Abuse), P3 (Supply Chain Injection), P4 (Host Breakout), P5 (Cloud IMDS Pivot), and P6 (Secrets Compromise).

    Sheet 03 Defense in Depth

    Layered Security Reference Architecture

    Defense-in-depth concentric zones: Cloud IAM & OIDC boundary, isolated SLSA CI/CD builder & Cosign signing, worker node isolation with Default-Deny NetworkPolicy, and Linux kernel MAC confinement.

    Sheet 04 Packet & Identity

    Packet and Identity Flow Analysis

    Detailed request flow pipeline: TLS 6443 → AuthN → AuthZ → Admission → Storage, ingress/egress data paths, east-west mTLS, and conditional breakout observation points.

    Attack Chains & Exploit Narratives (P1–P6)

    Real-world adversary trajectories from perimeter breach to host escape. Click any scenario to zoom directly to Sheet 2 and open production remediation policies.

    P1 · Ingress Exploit 🔴 Priority 1

    Ingress to Pod Takeover

    Attacker targets a public ingress service exploiting RCE/SSRF (e.g. Log4j CVE-2021-44228) to drop a reverse shell into an interactive container pod.

    Actor: TA01 Vectors: AV01, AV05 MITRE: T1190
    P2 · Token Abuse 🔴 Priority 1

    Token Abuse & API Pivot

    Attacker harvests mounted ServiceAccount tokens from /var/run/secrets to query the Kubernetes API server and escalate to cluster-admin.

    Actor: TA02, TA03 Vectors: AV03, AV09 MITRE: T1552.007
    P3 · Supply Chain 🔴 Priority 1

    Supply Chain Poisoning

    Adversary compromises upstream CI/CD runners or registry credentials to inject a backdoored container image, deployed past runtime perimeters.

    Actor: TA05 Vectors: AV15, AV16 MITRE: T1195.002
    P4 · Host Breakout 🔴 Priority 1

    Pod Breakout to Node Root

    Overprivileged flags (privileged: true, hostPID, SYS_ADMIN) or kernel CVEs (Dirty Pipe) break the container sandbox onto the host OS.

    Actor: TA03 Vectors: AV04, AV26 MITRE: T1611
    P5 · IMDS Pivot 🟠 Priority 2

    Cloud Metadata IAM Pivot

    Attacker probes the link-local metadata address (169.254.169.254) from a container pod, exfiltrating temporary node IAM role security credentials.

    Actor: TA03 Vectors: AV10, AV20 MITRE: T1552.005
    P6 · Secrets Compromise 🔴 Priority 1

    Datastore & Secrets Harvest

    Attacker accesses unencrypted etcd datastores or backup snapshots without KMS v2 encryption at rest, recovering cluster-wide secrets in plaintext.

    Actor: TA02, TA06 Vectors: AV06, AV24, AV25 MITRE: T1005

    Cluster Trust Boundaries (4 Envelopes)

    Trust Boundary 01

    ClusterControlPlane (CP)

    High-trust isolation envelope hosting kube-apiserver, kube-scheduler, kube-controller-manager, and cloud-controller-manager. Protected by mTLS, dedicated CAs, and fine-grained RBAC.

    Trust Boundary 02

    ClusterControlPlaneData (CPD)

    The datastore boundary protecting etcd and KMS envelope keys. Direct network access must be strictly forbidden except from authorized kube-apiserver endpoints using dedicated client certificates.

    Trust Boundary 03

    ClusterDataPlane (DP)

    Worker nodes hosting kubelet, kube-proxy, container runtime engines (containerd/CRI-O), and untrusted customer pods. Pods must be constrained with Seccomp, AppArmor/SELinux, and non-root SecurityContexts.

    Trust Boundary 04

    External & Supply Chain

    OCI registries, CI/CD runners, cloud provider APIs (IAM, VPC, metadata service), and public internet actors. Enforce cryptographic image signing (Cosign), SLSA provenance, and IMDSv2 metadata protection.

    Threat Actors Catalog (TA01–TA07)

    TA01 Internet Origin

    External Attacker

    Unauthenticated internet adversary probing public Ingress endpoints, exposed API servers, and unpatched web application vulnerabilities.

    TA02 Insider Origin

    Malicious Insider

    Authenticated employee, developer, or compromised credential holder attempting privilege escalation to cluster-admin or reading secrets across namespaces.

    TA03 Workload Origin

    Compromised Workload

    An adversary with an active shell inside a container pod. Steals mounted ServiceAccount tokens and probes the flat CNI network or Cloud IMDS (169.254.169.254).

    TA04 Tenant Origin

    Rogue Multi-Tenant Actor

    A valid tenant in a shared multi-tenant cluster attempting cross-namespace network sniffing, resource starvation (noisy neighbor), or cluster-wide CRD tampering.

    TA05 Registry Origin

    Supply Chain Poisoner

    Injects backdoor malware into upstream container registries, base images, or CI/CD pipelines, evading boundary firewalls by piggybacking on valid image pulls.

    TA06 Cloud Provider Origin

    Cloud & Hypervisor Operator

    Infrastructure personnel or processes with hypervisor console access, unencrypted storage volume snapshots (EBS), or cloud VPC routing table authority.

    TA07 Physical / Hardware Origin

    Hardware & Physical Adversary

    Adversary with physical access to server racks, bare-metal nodes, BMC/IPMI interfaces, or stolen unencrypted NVMe storage volumes executing cold-boot attacks.

    API Request & Packet Flow Checkpoints (6 Stages)

    Deterministic execution path of every incoming request to the Kubernetes control plane before state persistence.

    Stage 01

    Client Identity

    OIDC tokens, X.509 client certificates, or projected ServiceAccount tokens.

    Stage 02

    API TLS (6443)

    mTLS termination with strict cipher suites, IP whitelisting, and load balancing.

    Stage 03

    Authentication (AuthN)

    TokenReview, Webhook authenticator, or CA verification validating user/group claims.

    Stage 04

    Authorization (AuthZ)

    RBAC ClusterRoleBindings, NodeRestriction, and SubjectAccessReview webhooks.

    Stage 05

    Admission Control

    Mutating webhooks → Validating webhooks → Pod Security Admission (PSA).

    Stage 06

    Storage & Encryption

    etcd v3 key-value persistence with KMS v2 envelope encryption of Secrets at rest.

    STRIDE Threat Modeling Taxonomy for Kubernetes

    Every component in KubeDaily's architecture is categorized by its primary STRIDE threat vulnerability and mitigation envelope. Click any letter pill to filter the interactive canvas.

    S · Spoofing

    Identity & Authenticator Spoofing

    Impersonating users, pods, nodes, or ServiceAccounts (anonymous access, ARP spoofing, client CA compromise).

    Defense: OIDC, mTLS, NodeRestriction
    T · Tampering

    State & Data Tampering

    Unauthorized mutation of cluster state, etcd records, container filesystems, or mutating webhook injection.

    Defense: Read-only rootfs, Cosign image signing
    R · Repudiation

    Audit Failure & Repudiation

    Executing administrative or cluster actions without non-repudiable audit logs, tamper-evident trails, or eBPF signals.

    Defense: RequestResponse AuditPolicy, Falco
    I · Disclosure

    Confidentiality & Disclosure

    Exposing secrets, API bearer tokens, cloud metadata (169.254.169.254), or unencrypted pod traffic in transit.

    Defense: KMS v2 encryption, IMDSv2 hop=1
    D · DoS

    Resource Starvation & DoS

    Exhausting API rate limits, etcd IOPS/disk space, worker node CPU/memory quotas, or iptables connection tables.

    Defense: PriorityClass, Quotas, API Fairness
    E · Escalation

    Privilege Escalation

    Escalating from unprivileged container process to host root OS, or from developer namespace Role to cluster-admin.

    Defense: PSA Restricted, Seccomp, AppArmor

    Production Hardening Controls & Detection Probes

    C01 NetworkPolicy

    Default-Deny Ingress & Egress

    Enforces zero-trust isolation on the flat CNI network. Microservices communicate strictly over whitelisted ports and explicit label selectors.

    C02 Pod Security

    PSA Restricted Profile

    Enforces non-root execution, drops all Linux capabilities, and requires read-only root filesystems and RuntimeDefault seccomp profiles.

    C03 KMS v2 Encryption

    etcd Envelope Encryption

    Encrypts all Secret and ConfigMap resources at rest in etcd using external cloud KMS plugins (AWS KMS, Cloud KMS, Vault) with DEK caching.

    C04 Admission Guardrails

    Kyverno & Admission Policies

    Enforces declarative governance policies across all namespaces, rejecting privileged containers and validating resource quotas in real time.

    C05 eBPF Detection

    Falco & Tetragon Probes

    Real-time kernel syscall tracing detecting reverse shells, namespace escapes (sys_setns), and IMDS credential access with automated Sigkill.

    C10 Supply Chain

    Cosign Cryptographic Signing

    Validates digital signatures and SLSA provenance attestations during image pull, preventing backdoored container images from ever running.

    C11 Cloud Metadata

    IMDSv2 Hop Limit = 1

    Enforces session token authorization and limits IP TTL hop count so link-local metadata requests cannot traverse container bridge interfaces.

    C12 Audit Policy

    RequestResponse Audit Logging

    Captures all administrative mutations, secret reads, and exec requests in tamper-evident audit logs streamed to external SIEM storage.

    C16 Kernel Syscalls

    Seccomp RuntimeDefault

    Blocks over 60 high-risk Linux system calls (ptrace, bpf, mount, reboot) inside all workload containers.

    C17 MAC Confinement

    AppArmor & SELinux Mandatory Access

    Enforces kernel Mandatory Access Control profiles that prevent container breakouts, socket hijacking, and unauthorized sensitive directory access.

    Policy-as-Code Ecosystem · 3 Engines

    Multi-Engine Policy-as-Code Library

    Select your enforcement standard: Kyverno (declarative YAML & Sigstore Cosign verification), In-Tree CEL (ValidatingAdmissionPolicy Kubernetes 1.30+ GA zero-latency in-apiserver evaluation), or OPA Gatekeeper (Rego ConstraintTemplate). Toggle engines per card or inspect directly in the interactive slide-over drawer.

    Kyverno · Enforce CRITICAL

    Disallow Privileged Containers

    Blocks workloads declaring privileged: true and host namespace sharing (hostPID, hostIPC, hostNetwork) to neutralize container-to-host breakouts (P4 / CVE-2024-21626). 

    pattern:
  spec:
    =(hostPID): false
    containers:
      - securityContext:
          =(privileged): false
    CIS § 5.2.1 MITRE T1611
    Kyverno · Enforce HIGH

    Require Read-Only Root Filesystem

    Enforces readOnlyRootFilesystem: true across all containers. Attackers exploiting RCE cannot download malware, compile rootkits, or alter binary packages (P1 / AV01). 

    pattern:
  spec:
    containers:
      - securityContext:
          readOnlyRootFilesystem: true
    CIS § 5.2.6 MITRE T1190
    Kyverno · verifyImages CRITICAL

    Verify Cryptographic Signatures

    Intercepts image pulls at the admission webhook, cryptographically verifying Sigstore Cosign signatures and SLSA build attestations before workloads deploy to cluster nodes (P3 / AV15). 

    verifyImages:
  - imageReferences: ["ghcr.io/myorg/*"]
    attestors:
      - entries:
          - keys:
              publicKeys: |- ...
    CIS § 5.4.1 MITRE T1195.002
    Kyverno · Enforce CRITICAL

    Restrict ServiceAccount Automount

    Enforces automountServiceAccountToken: false on pods. Prevents adversaries from exfiltrating projected JWT bearer tokens to execute control plane API discovery (P2 / AV02). 

    pattern:
  spec:
    automountServiceAccountToken: false
    CIS § 5.1.5 MITRE T1552.007
    Kyverno · Generate CRITICAL

    Block Cloud Metadata (IMDS)

    Automatically generates an egress NetworkPolicy denying link-local address 169.254.169.254/32 upon Namespace creation, blocking AWS/GCP/Azure instance role theft (P5 / AV10). 

    generate:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  data:
    spec:
      policyTypes: ["Egress"]
    CIS § 5.2.2 MITRE T1552.005
    Kyverno · Enforce HIGH

    Require Non-Root Execution

    Rejects any pod configuration running as root (UID 0) by validating runAsNonRoot: true, ensuring containers run under unprivileged Unix UIDs. 

    pattern:
  spec:
    securityContext:
      runAsNonRoot: true
    CIS § 5.2.4 MITRE T1548
    Kyverno · Enforce CRITICAL

    Drop ALL POSIX Capabilities

    Strips all POSIX capabilities (capabilities.drop: ["ALL"]) to eliminate dangerous kernel privileges (CAP_SYS_ADMIN, CAP_NET_RAW, CAP_DAC_OVERRIDE). 

    pattern:
  spec:
    containers:
      - securityContext:
          capabilities:
            drop: ["ALL"]
    CIS § 5.2.8 MITRE T1611
    Kyverno · Generate HIGH

    Auto-Generate Default-Deny NetPol

    Watches for new Namespace objects and automatically generates synchronized default-deny ingress and egress NetworkPolicies to lock down the flat CNI network. 

    generate:
  apiVersion: networking.k8s.io/v1
  kind: NetworkPolicy
  name: default-deny-all
    CIS § 5.3.2 MITRE T1040
    Interactive Audit · Client-Side Zero-Trust Evaluation

    Cluster Hardening Scorecard & Posture Auditor

    Audit your Kubernetes cluster security against 20 enterprise controls across 5 core security domains. Toggle controls to compute your live Posture Rating, test CLI verification commands, and dynamically export unified remediation policy bundles (Kyverno, In-Tree CEL, or OPA Gatekeeper) or download a formal compliance audit report.

    0%
    Posture Rating
    CRITICAL RISK
    Severe attack vectors exposed
    Implemented Controls
    0 / 20
    20 gaps to remediate
    Critical Gaps Remaining
    13 PRI-1
    Immediate container breakout risk
    Active Remediation Engine
    Used for all 1-click bundle downloads
    Profiles:
    Adversary Tactics & Techniques · MITRE ATT&CK® for Containers

    MITRE ATT&CK® for Containers Matrix Heatmap

    Explore the 10 tactical container phases from Initial Access to Impact. Each adversary technique is linked to real Kubernetes attack scenarios, defense controls, detection signatures, and interactive nodes in the architecture diagram. Filter by tactical phase, search by technique name or ID, and export an official MITRE ATT&CK Navigator Layer JSON.

    🌐 MITRE Containers Matrix ↗
    🔍
    Heatmap Risk: Critical (Host Escape) High (Cred Theft) Medium (Recon)
    Hands-on Security Engineering · KinD / Minikube Lab Runbooks

    Red/Blue Team Attack Simulation Playbooks

    Validate your cluster's defense posture using real, executable attack scripts and counter-measure verifications across all 6 threat model attack scenarios (P1 to P6). Switch between Red Team (offensive simulation) and Blue Team (defensive validation) modes, copy terminal commands with 1 click, or download complete runnable Bash scripts.

    LAB-P1 INTERMEDIATE AV01, AV11 · MITRE T1190

    Playbook 1: Ingress RCE & Malware Drop Containment

    Simulating adversary attack steps against running cluster
    Tactical Objective:
    Simulate remote code execution vulnerability on public ingress pod and write backdoor binary to root filesystem.
    lab-p1-redteam.sh
    Production Ready Artifacts · 1-Click Deployment Bundles

    1-Click Production Security Bundles

    Deploy enterprise Kubernetes defense guardrails in seconds. Each bundle compiles battle-tested YAML configurations, NetworkPolicies, and eBPF detection rules into unified downloadable manifests ready to pipe directly into kubectl apply -f.

    Policy-as-Code 8 ClusterPolicies

    Kyverno Zero-Trust Suite

    Enforce PSS Restricted, drop all Linux capabilities, require non-root execution, disallow automounting SA tokens, and auto-generate default-deny NetworkPolicies across all tenant namespaces.

    P1 P2 P4 C02 C09
    In-Tree CEL K8s 1.30+ GA

    In-Tree CEL Admission Suite

    Zero-latency in-apiserver ValidatingAdmissionPolicy bindings evaluating Common Expression Language rules without admission webhook latency or external controller dependencies.

    CIS § 5.2.1 Zero Webhook CEL GA
    Network Security Zero-Trust CNI

    Zero-Trust NetworkPolicy Suite

    Tiered CNI architecture locking down pod-to-pod network scanning: default-deny all, CoreDNS allowlist, explicit Cloud IMDS 169.254.169.254 denial, and ingress gateway routing.

    Calico Cilium AWS VPC CNI
    Runtime Defense Falco 0.37+

    Falco eBPF Threat Detection

    Real-time kernel syscall tracing rules for interactive shell spawns, rootfs tampering in /bin, nsenter breakout pivots, cloud IMDS reconnaissance, and cryptomining pool traffic.

    eBPF Probes Syscall Auditing
    CIS Compliance CIS v1.8 Benchmark

    CIS Benchmark Hardening Suite

    Production Pod Security Standards (PSS) Restricted labels, Kubernetes API Server advanced audit policy manifest, and Seccomp RuntimeDefault profile configuration.

    AuditPolicy PSS Restricted
    Emergency SecOps Procedures · Active Incident Containment

    Incident Response & Containment Runbooks

    Emergency step-by-step containment procedures for SecOps, Platform, and SRE on-call engineers. Rapidly quarantine compromised pods, sever cloud IMDS exfiltration routes, capture live forensic memory checkpoints, and cordon compromised nodes during an active breach.

    Developer & Platform Tooling mix kubedaily.drawio

    Automated Elixir Pipeline for Draw.io Compilation

    KubeDaily features a built-in Mix task that watches and compiles .drawio XML diagram files into web-optimized, high-resolution vector SVGs and Retina-ready PNG assets using local Playwright and the official diagrams.net GraphViewer rendering engine. 

    # Compile all 4 threat model diagram sheets
mix kubedaily.drawio

# Compile a custom diagram with 2x Retina PNG export
mix kubedaily.drawio path/to/architecture.drawio --scale 2 --out-dir priv/static/kubedaily/images