Reach the node role from inside EKS or GKE
A pod without IMDS restrictions can grab the node instance role, which is usually far more privileged than the pod identity.
Tag: kubernetes
Escape a privileged pod to the node
A privileged or hostPath-mounting pod is a foothold on the node; mount the host filesystem or use host namespaces.
Abuse a mounted Kubernetes service account token
A shell in a pod usually has a service account token; check what it can do against the API before anything else.