Kubernetes Cluster Security Audit Without a Kubernetes Cluster

Not many people know how to break Kubernetes, much less how to break Kubernetes when it doesn't even exist yet. I'll share my experience of conducting cluster audits at the design stage, when all you have on hand are the Cluster API manifests of future Kubernetes. I'll tell you what types of flaws can be detected at this stage, and which ones can't. I'll dilute all this with interesting moments and automation of the process.