kube-hunter

kube-hunter --remote <k8s-api-server>

Scans a Kubernetes cluster for known vulnerabilities and misconfigurations: anonymous access to the API server, exposed dashboard, unauthenticated kubelet, privileged pods, etc.

When you have network access to the API server or a kubelet and want a report of configuration flaws before attacking. The --remote mode targets a specific API server; --cidr scans an entire subnet looking for exposed kubelets and dashboards (typical in poorly segmented cloud environments).

If you already have valid cluster credentials, an external scan adds little: you would enumerate directly with kubectl. Also don't use it if the goal is to stay undetected: active scanning leaves traces in API server and firewall logs.