---
name: rt-exploit-containers
description: "Container and Kubernetes security assessment skill for authorized review of images, runtime posture, RBAC, secrets, network policy, admission controls, and cloud workload identity."
---

# rt-exploit-containers - Container and Kubernetes Assessment

## Overview

Container security risk spans build pipelines, images, registries, runtime privileges, Kubernetes RBAC, service accounts, secrets, workload identity, and network boundaries. This skill focuses on safe configuration validation and blast-radius analysis.

## Prerequisites

- In-scope clusters, namespaces, registries, and workloads.
- Read-only kubeconfig or approved cloud role.
- Test namespace if active validation is approved.
- Production disruption constraints.
- Secret handling rules.

## Assessment Areas

| Area | Checks |
|---|---|
| Images | Base image age, critical CVEs, embedded secrets, provenance. |
| Runtime | Privileged mode, host mounts, host networking, capabilities. |
| Kubernetes RBAC | Service account permissions, wildcard verbs/resources, cluster-admin. |
| Secrets | Plaintext env vars, broad secret access, rotation process. |
| Network | Namespace isolation, ingress/egress policy, metadata access. |
| Admission | Pod Security Standards, image signing, policy enforcement. |
| Cloud Identity | IRSA/workload identity permissions and trust boundaries. |

## Workflow

1. Inventory clusters, namespaces, and workloads.
2. Review RBAC from least-privilege perspective.
3. Review pod specs for risky runtime settings.
4. Check secrets exposure and environment variables.
5. Review image security and registry controls.
6. Model whether a pod compromise can reach host, cluster admin, or cloud admin.
7. Document control gaps and remediation sequence.

## Evidence

Use sanitized manifests, RBAC summaries, screenshots from cloud console, and scanner output with secret values redacted.

## Remediation

- Enforce restricted Pod Security Standards.
- Remove privileged containers and host mounts.
- Reduce service account permissions.
- Add network policies.
- Use secret managers and rotation.
- Sign images and enforce trusted registries.
- Add runtime detection for suspicious process/network behavior.

