Description
Controllers are responsible for pods state using a declaration of pod definition. Pods utilize a service account associated with them to communicate with the Kubernetes API, and that service account is mounted by default to any newly created containers. Orca has detected that the Controller {K8sController} creates pods that can execute code or command in a container or ""attaching"" to a container. An attacker with access to the pod's container can extract the service account token and impersonate to it in order to gain a persistence foothold of the {K8sController.PodSpec.K8sCluster} cluster or to gain access to sensitive data accessible by other pods.
Lateral movement
