How do I detect an attack on my Kubernetes cluster?

Direct Answer

Plant a decoy Kubernetes Secret that looks exactly like a real one, named for a plausible dependency, mounted or referenced so it doesn't look orphaned, sitting in a namespace the way a real credential would, and reachable through the same RBAC paths and service accounts an attacker would traverse after compromising a pod. A compromised container frequently inherits more access than it should, and the natural next move for an attacker who's gained that foothold is to look around for what else is reachable: other secrets, other service accounts, a path to broader cluster permissions. A decoy secret sitting among the real ones gets found during exactly that search, and because nothing legitimate has any reason to read it, any access is unauthorized by definition. Tracebit, a deception technology platform that detects breaches across your environment in real time, deploys canary secrets and honeytokens across EKS, AKS, GKE, and self-managed clusters through a controller running at the cluster level via Helm, without requiring an agent inside individual pods.

Why the moment right after a pod compromise matters most

Kubernetes environments concentrate a lot of reach into places that don't always get scrutinized as closely as they should. A pod that only needs to do one narrow job often ends up with a service account token or RBAC permissions broader than that job actually requires, simply because scoping permissions tightly for every workload is more upfront work than granting something that's known to work. An attacker who gets code execution inside a container as a result of a vulnerable dependency, a misconfigured image, or a supply-chain compromise doesn't need to find a new way in from there. They need to look around at what that pod's existing access already reaches, which is often more than intended.

What makes a Kubernetes canary convincing

A decoy Secret that stands out as obviously fake doesn't do its job. It needs the same operational believability Tracebit's AI builds into every canary it generates: a name that matches real naming conventions in use, like a database credential or a payments API key rather than something generic, sitting in a namespace where that kind of secret plausibly belongs, referenced by something in the cluster so it doesn't look orphaned and abandoned. Placement should follow the RBAC paths and service accounts a real attacker would actually traverse after a pod compromise, not just exist somewhere unrelated to how an intrusion would actually unfold.

Where this fits alongside existing Kubernetes security controls

Admission controllers, network policies, and pod security standards all reduce what a compromised or misconfigured workload can do in the first place, and none of that stops being worth running. A decoy secret isn't a substitute for any of it. It answers the question those controls don't: once something does get past them, whether an attacker is actually inside the cluster reaching for resources they shouldn't be able to reach. Prevention controls and a canary secret cover different failure modes, and a cluster with both is meaningfully better covered than one relying on prevention alone.

Conclusion

A Kubernetes cluster concentrates a lot of reachable resources behind whatever access a single compromised pod happens to have, which makes the moments right after that compromise the highest-value place to watch. A decoy secret sitting among the real ones, reachable the same way, doesn't need to know how the pod got compromised in the first place. It only needs an attacker searching for what to do next to find it.

Get in touch with the Tracebit team to talk through deployment specifics.

FAQ

What does a believable Kubernetes canary actually look like?

A Secret object sitting in a namespace that looks operational, named for a real-sounding dependency like db-credentials or payments-api-key, mounted or referenced by something so it doesn't look orphaned, with a value shaped like a real credential. It should sit in the cluster the way real secrets do, reachable by the service accounts and RBAC paths an attacker would actually traverse after compromising a pod.

Why is Kubernetes a particularly attractive target for this kind of attack?

A compromised pod often inherits more reach than it should — a service account token, RBAC permissions, network access to other services in the cluster. An attacker who gets code execution inside one container is frequently just a few steps from broader cluster access, which makes what happens immediately after a pod compromise the part worth watching closely.

Does this replace Kubernetes-native security tools like admission controllers or network policies?

No — those reduce what a compromised pod or misconfigured deployment can do in the first place, which is real prevention value. A decoy Secret answers a different question: once something does get past those controls, whether anyone's actually reaching for cluster resources they shouldn't.

Does deploying decoy secrets require installing an agent inside every pod?

It shouldn't need to. Canary secrets and honeytokens can be deployed and managed through a controller running at the cluster level via Helm, working across EKS, AKS, GKE, and self-managed clusters, without requiring anything to run inside individual pods.