Skip to content

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.

Glossary

pods/exec

The Kubernetes Pod subresource used by kubectl exec to run a command in a running container; its audit event carries the command in requestURI.

pods/exec is the subresource behind kubectl exec (and kubectl cp, which runs tar through it). A request to it opens a streaming session into a container. In the audit log it appears with objectRef.subresource: exec, verb create or get depending on client and server versions, response code 101 when the session opens, and each argument as a command= parameter in requestURI.

The session's content is not logged. Exec by a service account, into kube-system, or with commands like chroot /host deserves attention. See how to detect kubectl exec (ATT&CK T1609).

This tool is not affiliated with, endorsed by or sponsored by The Linux Foundation, the Cloud Native Computing Foundation (CNCF) or the Kubernetes project. Kubernetes and K8s are registered trademarks of The Linux Foundation. EKS, GKE, AKS and other names are trademarks of their respective owners.