Building a Kubernetes-native purple team platform: What static scanners miss

Short summary

A developer built NEMESIS, a Kubernetes-native purple team platform that runs as a DaemonSet inside the cluster to execute real attack scenarios from the pod network. Despite Trivy, kube-bench, and Polaris all reporting green, NEMESIS discovered misconfigured RBAC, exposed secrets in ConfigMaps, and inadequate NetworkPolicy enforcement. The platform uses a Python controller for orchestration and a Go attack agent for execution, with Cilium eBPF telemetry providing flow-level attack visibility.

• •NEMESIS runs as a DaemonSet inside Kubernetes, executing attack primitives from the pod network — not static manifest scanning
• •Three scanners (Trivy, kube-bench, Polaris) all passed, but NEMESIS found exposed secrets, over-permissive RBAC, and weak network policies
• •Python controller orchestrates scenarios; Go agent executes attacks; Cilium eBPF provides kernel-level packet telemetry

Generated with AI, which can make mistakes.