Kubernetes API limitations in finding non-standard pods and containers

This report examines visibility gaps in Kubernetes for non-standard pods and containers—static, mirror, init, pause, and ephemeral—highlighting how adversaries can exploit these blind spots for stealth and persistence. It details how these objects are created, where and how they can (or cannot) be observed via the Kubernetes API, and provides guidance and example commands for detection and monitoring, emphasizing the need for complementary runtime visibility beyond the API.