Homelab Engineer Exposes Kubernetes Security Gaps That Three Scanners Missed

A software engineer running a homelab Kubernetes cluster found that three widely used security tools — Trivy, kube-bench, and Polaris — all reported a clean bill of health despite real exploitable vulnerabilities. To test runtime security, the engineer built NEMESIS, a purple team platform deployed as a DaemonSet inside the cluster, allowing attack simulations from within the same pod network as real workloads. The platform uses a Python controller for orchestration and a Go-based attack agent on every node to execute scenarios including token abuse, lateral movement, and data exfiltration probes. During one test, the agent discovered that the default service account had a ClusterRoleBinding granting read access across all namespaces, enabling it to retrieve a hard-coded PostgreSQL password stored in a ConfigMap. The exercise highlighted a key limitation of static analysis tools: they audit declared configurations but cannot detect what an attacker can actually do once inside a running cluster.