kube-hunter

kube-hunter --remote <k8s-ip>

Scans the Kubernetes cluster with kube-hunter (the offensive view), detecting cluster exposures and attack vectors.

Run it when you want the offensive view of the cluster (the attacker's view): kube-hunter in remote mode tests exposures — open API, unauthenticated kubelet, exposed dashboard, accessible etcd — and reports findings with severity and attack vector. It's Aqua's offensive tool: the complement to kube-bench (the defensive one). In K8s DevSecOps, kube-hunter validates the cluster's surface from the attacker's perspective: found exposures are fixed (and kube-bench covers them in CIS).

Don't use it in production: remote scanning tests exposures (real traffic to the cluster) — the testing environment is the place (or authorized scanning). And note: kube-hunter is the external view — internal configurations (RBAC, policies) are covered by kube-bench (037) and runtime tools; a kube-hunter finding (an exposure) is confirmed before remediation. The kube-hunter project is barely maintained (the current alternative is kube-bench + kubeaudit): check the version.