This repository was archived by the owner on Nov 15, 2023. It is now read-only.

Description
Even where authentication is generally required, Kubernetes makes some API server paths available unauthenticated as part of the system:discovery cluster role. Whilst this has been locked down a bit in the latest versions many clusters will disclose some interesting information without authentication on the API server port, which gets returned via the type:kubernetes search.
The paths allowed by the role are as below. Probably the interesting ones are /version which shows things like software version and discloses some info. about the type of install and /swagger.json which can disclose info. about software installed on the cluster.
- /api
- /api/*
- /apis
- /apis/*
- /healthz
- /openapi
- /openapi/*
- /swagger-2.0.0.pb-v1
- /swagger.json
- /swaggerapi
- /swaggerapi/*
- /version
- /version/