DNS Spoofing on Kubernetes Clusters

This report demonstrates a proof-of-concept Kubernetes network attack in which a malicious pod with CAP_NET_RAW can ARP-spoof the node bridge (cbr0) to impersonate CoreDNS, intercept and spoof DNS responses cluster-wide, and run a DNS proxy to enable MITM of pod traffic; the post provides scapy-based PoC code, detection guidance, and mitigations (drop NET_RAW, use L3 CNI/OVS-based CNIs, run kube-hunter).