Making Sense of Kubernetes Initial Access Vectors Part 1 – Control Plane

This article outlines a taxonomy of Kubernetes control plane initial access vectors and their security implications, emphasizing how misconfigurations and weak defaults can enable unauthenticated API access, kubeconfig credential leakage (notably long-lived AKS certs), misuse of kubectl proxy, insecure Kubelet API exposure, and publicly accessible management dashboards. It provides risk context and high-level detection and prevention guidance, underscoring that securing initial access is critical to limiting lateral movement and privilege escalation within clusters.