Skip to content

Home

Welcome to the KubeHound documentation!

KubeHound logo

KubeHound creates a graph of attack paths in a Kubernetes cluster, allowing you to identify direct and multi-hop routes an attacker is able to take, visually or through complex graph queries.

A KubeHound graph showing attack paths between pods, nodes, and identities (click to enlarge)

KubeHound can identify more than 25 attacks, from container escapes to lateral movement.

After it has ingested data from your cluster, it can easily answer advanced questions such as:

  • What are all possible container escapes in the cluster?
  • What is the shortest exploitable path between a publicly-exposed service and a cluster administrator role?
  • Is there an attack path from a specific container to a node in the cluster?

KubeHound was built with efficiency in mind and can consequently handle very large clusters. Ingestion and computation of attack paths typically takes a few seconds for a cluster with 1'000 running pods, 2 minutes for 10'000 pods, and 5 minutes for 25'000 pods.

Next steps: