← ReflexSec
Kubernetes
Every command ReflexSec uses, with the explanation behind the call. No timer — read at your own pace.
AllFile SystemNetworkingPrivilege EscalationPersistenceCredential AccessData ExfiltrationProcess ExecutionShellContainersCloudGit / DevelopmentLinuxmacOSWindowsPowerShellPythonJavaScript / NodeDockerKubernetesCI/CDWeb Security
- Safe
kubectl get pods -n defaultIntermediate - Dangerous
kubectl delete namespace productionIntermediate - Safe
kubectl describe pod web-0Advanced - Safe
kubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -dExpert - Dangerous
kubectl create clusterrolebinding sa-admin --clusterrole=cluster-admin --serviceaccount=default:defaultExpert - Safe
kubectl auth can-i --list --as=system:serviceaccount:default:defaultNightmare - Safe
kubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.spec.containers[*].image}{"\n"}{end}' | sort | uniq -c | sort -rnNightmare - Dangerous
kubectl patch daemonset node-agent -n kube-system --type=json -p='[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value":{"privileged":true}}]'Nightmare - Safe
kubectl rollout undo deployment/apiProAdvanced - Safe
kubectl diff -f ./k8s/api-deployment.yamlProExpert - Safe
curl -s https://api.example.com/v2/pods | jq '.items | length'ProIntermediate - Safe
kubectl exec api-0 -- df -h /dataProIntermediate - Dangerous
kubectl delete pvc --all -n productionProIntermediate - Dangerous
kubectl scale deployment/api --replicas=0 -n productionProIntermediate - Safe
watch -n5 kubectl get pods -n production -o wideProIntermediate - Safe
kubectl logs deploy/api --since=15m --tail=200ProAdvanced - Safe
kubectl cp api-0:/var/log/app/crash.log ./crash.logProAdvanced - Safe
kubectl drain node-3 --ignore-daemonsets --dry-run=serverProAdvanced - Dangerous
kubectl delete pod postgres-0 --force --grace-period=0ProAdvanced - Dangerous
kubectl drain node-3 --ignore-daemonsets --delete-emptydir-data --forceProAdvanced - Dangerous
kubectl replace --force -f ./k8s/statefulset.yamlProExpert - Safe
kubectl get pods -n production -o custom-columns='NAME:.metadata.name,PRIV:.spec.containers[*].securityContext.privileged'ProExpert - Safe
ETCDCTL_API=3 etcdctl --endpoints=https://localhost:2379 snapshot save /backup/etcd.dbProNightmare - Dangerous
kubectl delete pod suspicious-7f9 --grace-period=0 --forceProAdvanced - Safe
kubectl cordon node-7ProExpert - Dangerous
kubectl rollout restart deployment/apiProExpert - Safe
kubectl get nodesBeginner - Safe
kubectl describe pod checkout-api-7d9f4Beginner - Dangerous
kubectl delete pvc data-postgres-0 -n stagingBeginner