In this lesson, you will learn how to proactively identify security weaknesses in your Kubernetes cluster by deploying kube-hunter to conduct active penetration testing.
While kube-bench (which we covered previously) checks your cluster against the CIS Kubernetes Benchmark—focusing on configuration compliance—kube-hunter takes a more offensive approach. It hunts for vulnerabilities by probing your cluster as an attacker would, looking for open ports, insecure dashboard configurations, or exposed secrets.
How Kube-hunter Works
kube-hunter can be run in two ways: as a standalone binary on your workstation or as a pod inside your cluster. Running it as a pod is highly effective because it allows the tool to test from "inside the perimeter," simulating an attacker who has already gained a foothold within your network.
To deploy it as a job, you can use a simple manifest:
apiVersion: batch/v1
kind: Job
metadata:
name: kube-hunter
spec:
template:
spec:
restartPolicy: OnFailure
containers:
- name: kube-hunter
image: aquasec/kube-hunter:latest
args: ["--remote", "localhost"]
Analyzing the Results
Once the job runs, kube-hunter scans your internal cluster services. It categorizes findings by vulnerability severity (Low, Medium, High, or Critical). Common findings might include:
- Anonymously accessible API servers: Allowing unauthorized users to list cluster resources.
- Insecure Dashboard exposure: Identifying if the Kubernetes Dashboard is reachable without authentication.
- Token exposure: Detecting if service account tokens are easily accessible through metadata services.
By running this tool regularly in your CI/CD pipeline or as a scheduled CronJob, you transform security from a static "set it and forget it" configuration task into a dynamic, defensive posture. It turns the theoretical risks of an exposed cluster into actionable data points you can remediate before they are exploited.
Key Takeaway: Kube-hunter performs active penetration testing by simulating attacker behavior from within your cluster, identifying real-world security gaps that configuration audits might miss.