k8s-sidecar-attack

You can capture Kubernetes pod traffic by leveraging the shared network namespace within a pod to passively sniff traffic from sidecar proxies like Istio Envoy. This approach enables traffic capture and inspection without modifying the cluster state.

Kubernetes containers in a Pod are vulnerable to traffic sniffing because they share a single network namespace. This architecture allows an attacker or researcher to observe unencrypted plain HTTP traffic passing between services via sidecar proxies.

The best way to detect sidecars in a Kubernetes cluster is to scan for Istio, Envoy, or Linkerd proxy containers and confirm shared network namespaces. This reveals whether pod traffic is exposed and susceptible to passive traffic observation.

To analyze sensitive data exposure from Kubernetes sidecar traffic, perform packet capture within the pod network namespace to reveal plain HTTP data. This helps identify traffic patterns and potential data exfiltration risks in the cluster.

Sidecar traffic capture does not modify the Kubernetes cluster state. The process enforces safe, auditable steps focused entirely on passive traffic observation and packet capture within the existing pod network namespace.