Rung: A Kubernetes Attack-Path Agent That Counts Preconditions, Not Just Permissions

A demo Kubernetes cluster showed that tools reporting all sixteen workloads as able to reach cluster-admin were overstating risk, when only six could actually do so. The author argues that a permission alone is not a capability, since mechanisms such as Pod Security Admission, projected service-account tokens, RBAC escalation prevention, and host reach block many apparent paths. Their open tool, Rung, builds on FalkorDB and adds an edge only when its precondition holds in the cluster snapshot, which cut the graph from 1,472 phantom token edges to accurate results. The project also layers an agent over graph algorithms so users can ask questions in plain English and receive attack paths, key chokepoints, and blast-radius answers. Each hop in a path is tied to the underlying cluster fact, along with its MITRE ATT&CK technique and CIS benchmark reference.