KubeHound: Identifying Attack Paths In Kubernetes Clusters At Scale

The speaker, a team lead on an adversary simulation team at Datadog, starts from the problem that individual Kubernetes misconfigurations and vulnerabilities are hard to judge in isolation. Whether a weakness matters depends on context such as exposure, identity and mounted volumes, and manual penetration testing does not scale to large fleets of clusters. The talk introduces KubeHound, which models a cluster as a graph: Kubernetes resources become vertices, possible attacker actions become edges, and critical assets such as cluster admin rights are the targets that define critical attack paths.

The middle of the talk covers the architecture and how the tool was validated. A collector pulls resource data from the Kubernetes API, an ingestor builds an in-memory graph that is queried with Gremlin, and a domain-specific language on top makes those queries easier to write. The tool can run locally from a single binary, or be deployed as a scheduled collector in each cluster with centralized ingestion. Safeguards limit load on the API. Attack scenarios were replayed in disposable kind clusters, and a regression suite rebuilds a vulnerable cluster for every change, with about 26 attacks covered so far. Ingestion time dropped from around an hour to roughly 35 seconds after performance work.

The closing part covers planned work and audience questions. Compliance benchmark checks were raised but are not yet implemented, and weighting attack paths by likelihood or noise was described as a future step. The main takeaway for practitioners is that a repeatable snapshot of attack paths helps prioritize fixes and track whether a cluster's security posture improves over time.