Kubernetes: Best Practices for Detecting Common Attacks

This report summarizes common Kubernetes attack vectors—anonymous API access, service account token compromise, remote pod exec, hostPath-based node compromise, and secrets exposure—explaining how attackers can abuse built-in Kubernetes features, what API-server logs reveal, recommended detection heuristics (usernames, user-agents, objectRef/subresource/verbs, anomalous resource/verb trends), and hardening best practices such as disabling anonymous access, enforcing RBAC/least privilege, and encrypting etcd secrets.