A debug pod with the whole node mounted
List pods across namespaces, read their security contexts as JSON, and find the privileged pod that mounts the node’s root filesystem into a container.
Briefing
The payments namespace is supposed to run only images from registry.corp.example with a locked-down security context. An alert says something in it is running as privileged.
kubectl get pods -A lists every pod. -o json gives the full spec, and jq picks out securityContext, volumes, and nodeName without scrolling.
ops-bastion · Kubernetes review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.