- Get API version
	- `curl -Lk https://<API_IP>/version --header "Authorization: Bearer $TOKEN"`
- Useful API endpoints
	- Spec
		- `https://<API_IP>/openapi/v2`
	- Secrets
		- `api/v1/namespaces/default/secrets/`
	- Account information
		- `api/v1/namespaces/default/serviceaccounts`
- Get Load Balancers
	- `kubectl get services --all-namespaces -o jsonpath='{range .items[?(@.spec.type=="LoadBalancer")]}{.status.loadBalancer.ingress[*].hostname}:{.spec.ports[*].port}{"\n"}{end}'`
- List pods in `kube-system` namespace
	- `kubectl get pods -n kube-system`
- Get all secrets (requires cluster admin permissions, usually `kube-system` token)
	- `kubectl get secrets --all-namespaces`
- List all pods running on current node to determine which secrets are accessible
	- `kubectl get pods --all-namespaces --field-selector spec.nodeName=<node_name>`
- Retrieve specific secret
	- `kubectl get secret <secret_name> -o json -n <namespace> | jq .data`
- Get External IP's of all nodes
	- `kubectl get nodes --all-namespaces -o jsonpath='{range .items[*].status.addresses[?(@.type=="ExternalIP")]}{.address}{"\n"}{end}'`
- Get Kubernetes API Server Config
	- `POD_NAME=$(kubectl get pods --namespace kube-system | grep kube-apiserver | head -1 | awk '{print $1}') && kubectl describe pod $POD_NAME --namespace kube-system`
- Get list of nodes sorted by creation time (useful for finding stable machines for persistence)
	- `kubectl get nodes –sort-by=.metadata.creationTimestamp`
- Get Kubernetes API Server Container Args
	- `POD_NAME=$(kubectl get pods --namespace kube-system | grep kube-apiserver | head -1 | awk '{print $1}') && kubectl get pod $POD_NAME --namespace kube-system -o json | jq -r '.spec.containers | .[] |select(.name == "kube-apiserver")| .args'`

- Get Network Policies
	- `kubectl get networkpolicy --all-namespaces`

- Get Cluster Admin Role Bindings
	- `kubectl get clusterrolebindings | grep "ClusterRole/cluster-admin"`

- Get Cluster Roles With Secrets Access
	- `kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "secrets" )|select(. != null)).metadata.name'`

- Get Roles With Secrets Access
	- `kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "secrets" )|select(. != null)).metadata.name'`

- Get Cluster Roles with Configmaps Access
	- `kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "configmaps" )|select(. != null)).metadata.name'`

- Get Roles with Configmaps Access
	- `kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "configmaps" )|select(. != null)).metadata.name'`

- Get Pods With Containers Without Resources Limits
	- `kubectl get pods --all-namespaces -o json | jq -r '.items[].spec.containers[] | select(.resources.limits == null).name'`

- Get All Containers Images
	- `kubectl get pods --all-namespaces -o json | jq -r '.items[].spec.containers[].image' | sort | uniq`

- Get cluster roles with wildcard resources
	- `kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "*" )|select(. != null)).metadata.name'`

- Get roles with wildcard resources
	- `kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "*" )|select(. != null)).metadata.name'`