<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Kubernetes Privilege Escalation Detection — API Reference

## kubectl Security Queries

```bash
# Find privileged containers
kubectl get pods -A -o json | \
  jq '.items[].spec.containers[] | select(.securityContext.privileged == true)'

# Find cluster-admin bindings
kubectl get clusterrolebindings -o json | \
  jq '.items[] | select(.roleRef.name == "cluster-admin")'

# List wildcard RBAC rules
kubectl get clusterroles -o json | \
  jq '.items[] | select(.rules[]?.verbs[]? == "*")'

# Check Pod Security labels
kubectl get namespaces -L pod-security.kubernetes.io/enforce
```

## Pod Security Context Fields

| Field | Risk | Description |
|-------|------|-------------|
| `privileged: true` | Critical | Full host access |
| `hostPID: true` | High | Host process namespace |
| `hostNetwork: true` | High | Host network stack |
| `hostPath` | High | Host filesystem access |
| `runAsUser: 0` | Medium | Root in container |
| `allowPrivilegeEscalation` | Medium | setuid binary risk |
| `capabilities.add` | Varies | Added Linux capabilities |

## RBAC Escalation Verbs

| Verb | Risk | Description |
|------|------|-------------|
| `escalate` | Critical | Modify roles beyond own permissions |
| `bind` | Critical | Bind to roles beyond own permissions |
| `impersonate` | High | Act as another user/SA |
| `*` (wildcard) | High | All operations on resource |
