### Kubelet configuration example

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/IDENTITY_ASSUME.md

Example structure of a kubelet configuration file showing client certificate paths.

```yaml
users:
- name: default-auth
  user:
    client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
    client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
```

--------------------------------

### Install kubectl and dependencies

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/ROLE_BIND.md

Installs necessary binaries like curl, jq, and kubectl. It determines the system architecture to download the correct kubectl binary and makes it executable.

```bash
ARCH=$(arch | sed s/aarch64/arm64/ | sed s/x86_64/amd64/)
apt update && apt install -y curl jq && curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl" && chmod +x kubectl
```

--------------------------------

### Run KubeHound Dashboard

Source: https://github.com/datadog/kubehound/blob/main/scripts/dashboard-demo/README.md

Commands to install dependencies and start the dashboard server using Poetry.

```bash
poetry install
poetry run panel serve main.py
```

--------------------------------

### Install KubeHound via Binary

Source: https://context7.com/datadog/kubehound/llms.txt

Download and install the latest KubeHound binary for your platform.

```bash
# Download the latest binary for your platform
wget https://github.com/DataDog/KubeHound/releases/latest/download/kubehound-$(uname -o | sed 's/GNU\///g')-$(uname -m) -O kubehound
chmod +x kubehound
```

--------------------------------

### Start MCP Host with Ollama Model

Source: https://github.com/datadog/kubehound/blob/main/exp/khaudit/README.md

Command to launch the mcphost tool with a specified Ollama model, useful for local MCP client setup with prompt capabilities.

```sh
# For local setup using ollama and a model that supports function calling.
mcphost -m ollama:qwen3:14b
```

--------------------------------

### Install KubeHound via Homebrew

Source: https://github.com/datadog/kubehound/blob/main/README.md

Update Homebrew and install the KubeHound package.

```bash
brew update && brew install kubehound
```

--------------------------------

### Start KubeHound Backend with Default Images

Source: https://github.com/datadog/kubehound/blob/main/docs/user-guide/common-operations.md

Use this command to start the KubeHound backend services using the latest released Docker images. Ensure Docker is running.

```bash
kubehound backend up
```

--------------------------------

### Commit Message Convention Example

Source: https://github.com/datadog/kubehound/blob/main/CONTRIBUTING.md

Follow this convention for commit messages, starting with the package name, followed by a colon and a description of the change.

```go
pkg/kubehound/graph: add new projected volume type support

Added a new volume type support (Amazon EBS) to the model
```

--------------------------------

### Install containerd CLI

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/POD_ATTACH.md

Download and extract the containerd binary for ARM64 architecture.

```bash
curl -L https://github.com/containerd/containerd/releases/download/v1.6.19/containerd-1.6.19-linux-arm64.tar.gz > containerd.tar.gz
tar -xzf containerd.tar.gz
```

--------------------------------

### Install KubeHound via Binary

Source: https://github.com/datadog/kubehound/blob/main/README.md

Download and set execution permissions for the KubeHound binary on Linux or macOS.

```bash
wget https://github.com/DataDog/KubeHound/releases/latest/download/kubehound-$(uname -o | sed 's/GNU\///g')-$(uname -m) -O kubehound
chmod +x kubehound
```

--------------------------------

### Install Debugger

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/CE_SYS_PTRACE.md

Install GDB within the container to facilitate process attachment.

```bash
apt update && apt install gdb
```

--------------------------------

### Execute KubeHound

Source: https://github.com/datadog/kubehound/blob/main/README.md

Run the KubeHound binary based on the installation method used.

```bash
# If you installed it from brew, it is in your path
kubehound

# If you installed it from release, it should be were you downloaded it
./kubehound

# If you installed it from source, it should be in the <repo_path>/bin/build folder
./bin/build/kubehound
```

--------------------------------

### Build the KubeHound project

Source: https://github.com/datadog/kubehound/blob/main/deployments/kubehound/graph/dsl/kubehound/README.md

Use this command to clean and install the project dependencies and artifacts.

```bash
mvn clean install
```

--------------------------------

### Start MCP Host with WhiteRabbitNeo Model

Source: https://github.com/datadog/kubehound/blob/main/exp/khaudit/README.md

Command to launch the mcphost tool using the locally created `whiterabbitneo:7b` Ollama model.

```sh
mcphost -m ollama:whiterabbitneo:7b
```

--------------------------------

### Example Output of 'ps ax' in Shared Namespace

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/SHARE_PS_NAMESPACE.md

This is an example output of the 'ps ax' command when run within a pod that has shared process namespaces enabled. It shows processes from both the 'shell' and 'nginx' containers.

```text
PID   USER     TIME  COMMAND
    1 root      0:00 /pause
    8 root      0:00 nginx: master process nginx -g daemon off;
   14 101       0:00 nginx: worker process
   15 root      0:00 sh
   21 root      0:00 ps ax
```

--------------------------------

### Example Usage: Find Services

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates retrieving all services, services with specific port names, or services with additional filters like port and limit.

```groovy
// All services in the graph
kh.services()

// All services in the graph with name filter
kh.services("jmx", "redis")

// All services in the graph with additional filters
kh.services().has("port", 9999).limit(10)
```

--------------------------------

### Example Usage: Find Pods

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates how to retrieve all pods, pods with specific names, or pods with additional filters like namespace and limit.

```groovy
// All pods in the graph
kh.pods()

// All pod in the graph with name filter
kh.pods("app-pod", "sidecar-pod")

// All pods in the graph with additional filters
kh.pods().has("namespace", "ns1").limit(10)
```

--------------------------------

### Install Python Dependency

Source: https://context7.com/datadog/kubehound/llms.txt

Command to install the required Gremlin Python driver.

```bash
pip install gremlinpython
```

--------------------------------

### Start KubeHound Backend with Custom Images

Source: https://github.com/datadog/kubehound/blob/main/docs/user-guide/common-operations.md

Start the KubeHound backend with custom Docker images by providing a `docker-compose.overrides.yml` file. This allows specifying different image registries or tags.

```yaml
name: kubehound-release
services:
  mongodb:
    image: your.registry.tld/mongo/mongo:6.0.6
    ports:
      - "127.0.0.1:27017:27017"

  kubegraph:
    image: your.registry.tld/datadog/kubehound-graph:my-specific-tag
    ports:
      - "127.0.0.1:8182:8182"
      - "127.0.0.1:8099:8099"
  
  ui-jupyter:
    image: your.registry.tld/datadog/kubehound-ui:my-specific-tag

  ui-invana-engine:
    image: your.registry.tld/invanalabs/invana-engine:latest

  ui-invana-studio:
    image: your.registry.tld/invanalabs/invana-studio:latest
```

--------------------------------

### Install KubeHound with Helm

Source: https://github.com/datadog/kubehound/blob/main/docs/khaas/deployment.md

Deploy KubeHound as a Service on a Kubernetes cluster using Helm. This command installs the `khaas` chart into the `khaas` namespace, creating it if it doesn't exist.

```bash
cd ./deployments/k8s
helm install khaas khaas --namespace khaas --create-namespace
```

--------------------------------

### List host disks

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/CE_PRIV_MOUNT.md

Install and use fdisk to identify available host disks visible from the container.

```bash
apt update && apt install fdisk
fdisk -l 
# -> /dev/vda1
```

--------------------------------

### Example Usage: Find Host Mounts

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates retrieving all host mounted volumes, host mounts filtered by source path, or host mounts with additional filters like app and limit.

```groovy
// All host mounted volumes in the graph
kh.hostMounts()

// All host mount volumes in the graph with source path filter
kh.hostMounts("/", "/proc")

// All host mount volumes in the graph with additional filters
kh.hostMounts().has("app", "web-app").limit(10)
```

--------------------------------

### Example Usage: Find Volumes

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates retrieving all volumes, volumes with specific names, or volumes with additional filters like sourcePath, app, and limit.

```groovy
// All volumes in the graph
kh.volumes()

// All volumes in the graph with name filter
kh.volumes("db-data", "proc-mount")

// All volumes in the graph with additional filters
kh.volumes().has("sourcePath", "/").has("app", "web-app")
```

--------------------------------

### Install Workshop Tools on macOS

Source: https://github.com/datadog/kubehound/blob/main/docs/workshop.md

Use Homebrew to install the necessary dependencies for the workshop on macOS.

```shell
brew update && brew install kubectl, kind, docker`
```

--------------------------------

### Pre-pull KubeHound Images

Source: https://github.com/datadog/kubehound/blob/main/docs/workshop.md

Initialize KubeHound to pull the required heavy images before starting the workshop.

```shell
./kubehound
```

--------------------------------

### Example Usage: Find Users

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates retrieving all users, users with specific names, or users with additional filters like app and limit.

```groovy
// All users in the graph
kh.users()

// All users in the graph with name filter
kh.users("postgres-admin", "db-reader")

// All users in the graph with additional filters
kh.users().has("app", "web-app").limit(10)
```

--------------------------------

### Execute criticalPathsFreq queries

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Examples of calculating path frequencies from services or specific groups.

```groovy
// Most common critical paths from services
kh.services().criticalPathsFreq()

// Most common critical paths from a compromised engineer credential of up to 4 hops
kh.group("engineering").criticalPathsFreq(4)
```

--------------------------------

### Example Usage: Find Nodes

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates how to retrieve all nodes, nodes with a specific name, or nodes with additional filters like team and limit.

```groovy
// All nodes in the graph
kh.nodes()

// All nodes in the graph with name filter
kh.nodes("control-plane")

// All nodes in the graph with additional filters
kh.nodes().has("team", "sre").limit(10)
```

--------------------------------

### Sample output for criticalPathsFreq

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Example JSON output showing path frequency counts.

```json
{
  "path[Endpoint, ENDPOINT_EXPLOIT, Container, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]": 6,
  "path[Endpoint, ENDPOINT_EXPLOIT, Container, VOLUME_DISCOVER, Volume, TOKEN_STEAL, Identity, PERMISSION_DISCOVER, PermissionSet]": 6,
  "path[Endpoint, ENDPOINT_EXPLOIT, Container, CE_NSENTER, Node, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]": 1,
  "path[Endpoint, ENDPOINT_EXPLOIT, Container, CE_MODULE_LOAD, Node, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]": 1,
  "path[Endpoint, ENDPOINT_EXPLOIT, Container, CE_PRIV_MOUNT, Node, IDENTITY_ASSUME, Identity, PERMISSION_DISCOVER, PermissionSet]": 1
}
```

--------------------------------

### Run Full Ingestion Pipeline

Source: https://context7.com/datadog/kubehound/llms.txt

Execute the complete pipeline to start backend services, dump resources, and build the attack graph.

```bash
# Set your target cluster context
kubectl config set-context my-cluster

# Run KubeHound (starts backend, dumps k8s data, builds graph)
kubehound

# Skip interactive confirmation prompt
kubehound -y
# or
kubehound --non-interactive
```

--------------------------------

### Start KubeHound Backend with Override File

Source: https://github.com/datadog/kubehound/blob/main/docs/user-guide/common-operations.md

Initiate the KubeHound backend services using a custom override file for Docker Compose configurations. This command applies the settings defined in `docker-compose.overrides.yml`.

```bash
kubehound backend up -f docker-compose.overrides.yml
```

--------------------------------

### Example Usage: Find Service Accounts

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates retrieving all service accounts, service accounts with specific names, or service accounts with additional filters like app and limit.

```groovy
// All service accounts in the graph
kh.sas()

// All service accounts in the graph with name filter
kh.sas("postgres-admin", "db-reader")

// All service accounts in the graph with additional filters
kh.sas().has("app", "web-app").limit(10)
```

--------------------------------

### Example Usage: Find Endpoints

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates retrieving all endpoints, endpoints with additional filters like port and limit, or endpoints with specific K8s service exposure.

```groovy
// All endpoints in the graph
kh.endpoints()

// All endpoints in the graph with additional filters
kh.endpoints().has("port", 3000).limit(10)

// All endpoints with K8s service exposure
kh.endpoints(EndpointExposure.External)
```

--------------------------------

### Example Usage: Find Container Escapes

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates how to retrieve all container escapes or escapes filtered by node name.

```groovy
// All container escapes in the graph
kh.escapes()

// All container escapes in the graph with node name filter
kh.escapes("control-plane")
```

--------------------------------

### KubeHound DSL: Basic Vertex Traversal

Source: https://context7.com/datadog/kubehound/llms.txt

Demonstrates basic KubeHound DSL usage for traversing graph vertices. Start with `kh` instead of Gremlin's `g` for simplified graph operations.

```groovy
// Basic DSL usage - first 100 vertices
kh.V().limit(100)
```

```groovy
// All containers in the graph
kh.containers()
```

```groovy
// Containers with name filter
kh.containers("elasticsearch", "mongo")
```

```groovy
// Chain with Gremlin methods
kh.containers().has("namespace", "production").limit(10)
```

--------------------------------

### Configure Graph Notebook Visualization Options

Source: https://github.com/datadog/kubehound/blob/main/deployments/kubehound/ui/shared/shared.ipynb

Set appearance customizations for the graph notebook. Refer to the provided link for a guide on possible options.

```python
%%graph_notebook_vis_options
{
  "edges": {
    "smooth": {
      "enabled": true,
      "type": "dynamic"
    }
  },
  "arrows": {
    "to": {
      "enabled": true,
      "type": "arrow"
    }
  }
}
```

--------------------------------

### Example Usage: Find Identities

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Demonstrates retrieving all identities, identities with specific names, or identities with additional filters like app and limit.

```groovy
// All identities in the graph
kh.identities()

// All identities in the graph with name filter
kh.identities("postgres-admin", "db-reader")

// All identities in the graph with additional filters
kh.identities().has("app", "web-app").limit(10)
```

--------------------------------

### KHaaS Remote Configuration Example

Source: https://context7.com/datadog/kubehound/llms.txt

Configure KubeHound as a Service (KHaaS) for distributed deployments by specifying blob storage, temporary directory, archive settings, and API endpoints.

```yaml
ingestor:
  blob:
    bucket_url: "s3://your-bucket"
    region: "us-east-1"
  temp_dir: "/tmp/kubehound"
  archive_name: "archive.tar.gz"
  max_archive_size: 2147483648  # 2GB
  api:
    endpoint: "127.0.0.1:9000"
    insecure: true
```

--------------------------------

### Display Gremlin Help

Source: https://github.com/datadog/kubehound/blob/main/deployments/kubehound/ui/README.md

Run this cell to display the help message for the `%%gremlin` magic command. No specific setup is required beyond having the magic command available.

```python
%%gremlin --help
g
```

--------------------------------

### Build KubeHound from Source

Source: https://github.com/datadog/kubehound/blob/main/README.md

Clone the repository, checkout the latest tag, and compile the binary.

```bash
git clone https://github.com/DataDog/KubeHound.git
cd KubeHound
git checkout $(git describe --tags --abbrev=0)
make build
```

--------------------------------

### Build KubeHound from Source

Source: https://context7.com/datadog/kubehound/llms.txt

Clone the repository and build the binary using the Makefile.

```bash
git clone https://github.com/DataDog/KubeHound.git
cd KubeHound
git checkout $(git describe --tags --abbrev=0)
make build
# Binary output: ./bin/build/kubehound
```

--------------------------------

### Check kubelet configuration

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/IDENTITY_ASSUME.md

Inspect the kubelet configuration file to locate client certificate paths.

```bash
cat $NODE_ROOT/etc/kubernetes/kubelet.conf
```

--------------------------------

### Generate KubeHound Wiki Locally

Source: https://github.com/datadog/kubehound/blob/main/docs/dev-guide/wiki.md

Executes the local build process for the documentation website.

```bash
make local-wiki
```

--------------------------------

### Deploy and Ingest Sample Data

Source: https://github.com/datadog/kubehound/blob/main/scripts/dashboard-demo/README.md

Automated script sequence to clone the repository, deploy a local kind cluster, and ingest data into KubeHound.

```bash
git clone https://github.com/DataDog/KubeHound/
cd KubeHound
make local-cluster-deploy
export KUBECONFIG=./test/setup/.kube-config
make build
./bin/kubehound
```

--------------------------------

### Endpoints API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices with a "Endpoint" label.

```APIDOC
## Endpoints API

### Description
Starts a traversal that finds all vertices with an "Endpoint" label.

### Method
GET (Implicit)

### Endpoint
/api/endpoints

### Parameters
#### Query Parameters
- **exposure** (EndpointExposure) - Optional - Filters endpoints by exposure type.

### Request Example
```groovy
kh.endpoints()
kh.endpoints(EndpointExposure.External)
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Endpoint vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "endpoint-1",
      "label": "Endpoint",
      "properties": {
        "port": 80,
        "exposure": "External"
      }
    }
  ]
}
```
```

--------------------------------

### Check for ctr utility

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/POD_ATTACH.md

Ensure that the `ctr` utility is installed on the node, which is necessary for interacting directly with containerd.

```bash
which ctr
```

--------------------------------

### Execute cluster traversal step

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal to find vertices associated with specific cluster names.

```java
GraphTraversal<Vertex, Vertex> cluster(String... names)
```

```groovy
// All vertices in the graph from the kind-kubehound.local cluster
kh.cluster("kind-kubehound.local")

// All containers in the graph from the kind-kubehound.local cluster
kh.cluster("kind-kubehound.local").containers()
```

--------------------------------

### Verify secret access permissions

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/TOKEN_BRUTEFORCE.md

Check if the current identity has permission to get secrets using kubectl.

```bash
kubectl auth can-i get secrets
```

--------------------------------

### Services API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices with a "Endpoint" label representing K8s services.

```APIDOC
## Services API

### Description
Starts a traversal that finds all vertices with an "Endpoint" label representing K8s services.

### Method
GET (Implicit)

### Endpoint
/api/services

### Parameters
#### Query Parameters
- **portNames** (String...) - Optional - Filters services by port name.

### Request Example
```groovy
kh.services()
kh.services("jmx", "redis")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Service vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "service-1",
      "label": "Endpoint",
      "properties": {
        "name": "my-service",
        "port": 8080
      }
    }
  ]
}
```
```

--------------------------------

### Execute containers traversal step

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal to find container vertices, with optional filtering by name or other properties.

```java
GraphTraversal<Vertex, Vertex> containers(String... names)
```

```groovy
// All containers in the graph
kh.containers()

// All containers in the graph with name filter
kh.containers("elasticsearch", "mongo")

// All containers in the graph with additional filters
kh.containers().has("namespace", "ns1").limit(10)
```

--------------------------------

### Execute run traversal step

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal to find vertices associated with specific KubeHound run IDs.

```java
GraphTraversal<Vertex, Vertex> run(String... ids)
```

```groovy
// All vertices in the graph from a single run
kh.run("01he5ebh73tah762qgdd5k4wqp")

// All vertices in the graph from a multiple runs
kh.run("01he5ebh73tah762qgdd5k4wqp", "01he5eagzbnhtfnwzg7xxbyfz4")

// All containers in the graph from a single run
kh.run("01he5ebh73tah762qgdd5k4wqp").containers()
```

--------------------------------

### Optimize query performance with limits

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/gremlin.md

Demonstrates using the limit step to prevent UI overloading when querying large clusters.

```go
g.V().has("class","Container").limit(5).outE()
```

--------------------------------

### JSONLD to HexTuples Conversion Example

Source: https://github.com/datadog/kubehound/blob/main/exp/khaudit/README.md

Illustrates the conversion of a JSONLD object representing a container into the HexTuples format for RDF serialization.

```json
{
  "@context": "https://kubehound.io/schemas/v1/vertices#Container",
  "@id": "urn:vertex:10475208976",
  "app": "postgres-haproxy-terry",
  "cluster": "test.cluster.local",
  "team": "postgres"
}
```

```json
[
  ["urn:vertex:10475208976", "label", "Container", "", "", ""],
  ["urn:vertex:10475208976", "app", "postgres-haproxy-terry", "", "", ""],
  ["urn:vertex:10475208976", "cluster", "test.cluster.local", "", "", ""],
  ["urn:vertex:10475208976", "team", "postgres", "", "", ""]
]
```

--------------------------------

### Build attack paths with outE and inV

Source: https://github.com/datadog/kubehound/blob/main/deployments/kubehound/ui/KubehoundDSL_101.ipynb

Demonstrates building a path using outgoing edges and incoming vertices, equivalent to the attacks() DSL function.

```gremlin
%%gremlin -d class -g critical -le 50 -p inv,oute

kh.containers().outE().inV().path().by(valueMap())
```

```gremlin
%%gremlin -d class -g critical -le 50 -p inv,oute

kh.containers().attacks().by(elementMap())
```

--------------------------------

### Execute Terraform Deployment Commands

Source: https://github.com/datadog/kubehound/blob/main/deployments/terraform/README.md

Standard sequence of commands to initialize, plan, and apply Terraform configurations.

```bash
terraform init
terraform plan
terraform apply
```

--------------------------------

### List Makefile commands

Source: https://github.com/datadog/kubehound/blob/main/docs/dev-guide/getting-started.md

Displays all available developer commands defined in the project Makefile.

```bash
make help
```

--------------------------------

### Groups Step

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices representing groups and optionally allows filtering of those vertices on the "name" property.

```APIDOC
## Groups Step

### Description
Starts a traversal that finds all vertices representing groups and optionally allows filtering of those vertices on the "name" property.

### Method
N/A (This is a traversal step, not a direct API endpoint)

### Endpoint
N/A

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```groovy
// All groups in the graph
kh.groups()

// All groups in the graph with name filter
kh.groups("postgres-admin", "db-reader")

// All groups in the graph with additional filters
kh.groups().has("app", "web-app").limit(10)
```

### Response
#### Success Response (200)
- **Vertex** (type) - Represents a group in the graph.

#### Response Example
(Depends on the specific traversal and filters applied)
```

--------------------------------

### Users API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices representing users and optionally allows filtering of those vertices on the "name" property.

```APIDOC
## Users API

### Description
Starts a traversal that finds all vertices representing users and optionally allows filtering of those vertices on the "name" property.

### Method
GET (Implicit)

### Endpoint
/api/users

### Parameters
#### Query Parameters
- **names** (String...) - Optional - Filters users by name.

### Request Example
```groovy
kh.users()
kh.users("postgres-admin", "db-reader")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of User vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "user-1",
      "label": "User",
      "properties": {
        "name": "postgres-admin"
      }
    }
  ]
}
```
```

--------------------------------

### Deploy local test cluster

Source: https://github.com/datadog/kubehound/blob/main/docs/dev-guide/testing.md

Initializes the Kind cluster required for system testing.

```bash
make local-cluster-deploy
```

--------------------------------

### Create Local Dump without Compression

Source: https://github.com/datadog/kubehound/blob/main/docs/user-guide/common-operations.md

Create a local dump of Kubernetes resources in raw format, without compression. Use this if you need direct access to the individual resource files.

```bash
kubehound dump local [directory to dump the data] --no-compress
```

--------------------------------

### Download and Extract crictl CLI

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/EXPLOIT_CONTAINERD_SOCK.md

Installs the crictl command-line tool, a utility for interacting with Kubernetes container runtimes, which is used for exploiting the containerd.sock vulnerability.

```bash
apt update && apt install -f wget tar
wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.27.0/crictl-v1.27.0-linux-amd64.tar.gz -O /tmp/crictl.tar.gz
tar xvf /tmp/crictl.tar.gz -C /tmp
```

--------------------------------

### Run unit tests

Source: https://github.com/datadog/kubehound/blob/main/docs/dev-guide/testing.md

Executes the full suite of unit tests locally.

```bash
make test
```

--------------------------------

### Check Mounted Directories for Service Account Tokens

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/EXPLOIT_HOST_TRAVERSE.md

Use this command to inspect the current mount points and identify any tmpfs mounts that might contain service account tokens. Look for paths related to '/hostpods' and 'kube-api-access'.

```bash
# The service account tokens are tmpfs mounts themselves so it is very apparent when they are present
cat /proc/self/mounts

# ...
/dev/vda1 /hostpods ext4 ro,relatime,discard 0 0
tmpfs /hostpods/063c7aae-1965-4824-b4f5-a8e7cdc2d224/volumes/kubernetes.io~projected/kube-api-access-zhzgh tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/648e72af-34a8-4be6-8e7a-9cfac7e7fd94/volumes/kubernetes.io~projected/kube-api-access-hkh28 tmpfs rw,relatime,size=51200k 0 0
tmpfs /hostpods/b8a7238c-83eb-4392-b055-ad08f8b8a218/volumes/kubernetes.io~projected/kube-api-access-xl5fz tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/5edf50d2-747c-45b2-8b40-210f1bfee866/volumes/kubernetes.io~projected/kube-api-access-2l9sx tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/f80874b0-1a52-4175-9705-550b75743adf/volumes/kubernetes.io~projected/kube-api-access-8ms4p tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/2e2811f3-cfb4-41ea-ae51-8e337357e0d0/volumes/kubernetes.io~projected/kube-api-access-7p2hf tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/37d46741-de8b-45b3-a0a4-874529bb4032/volumes/kubernetes.io~projected/kube-api-access-g8wqm tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/05ae5550-ac58-47a3-b466-c09944240062/volumes/kubernetes.io~projected/kube-api-access-pdqmc tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/3a55670f-a784-4d3c-8231-5bf90c54fc87/volumes/kubernetes.io~projected/kube-api-access-2bf8s tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/b40f8657-5a06-49ed-9128-b807de3281e5/volumes/kubernetes.io~projected/kube-api-access-hjbzn tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/4eb7074e-133f-4ecc-8fa4-a686cf46ba6d/volumes/kubernetes.io~projected/kube-api-access-wqsqv tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/23dab617-9d86-4658-823b-12aaab1f0edc/volumes/kubernetes.io~projected/kube-api-access-xd5fl tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/300cbaef-f0aa-441b-b22d-154bfa31901a/volumes/kubernetes.io~projected/kube-api-access-5xwr4 tmpfs rw,relatime,size=15340756k 0 0
tmpfs /hostpods/e949b9f2-304b-4664-93e5-d0ca79d69448/volumes/kubernetes.io~projected/kube-api-access-xrbr4 tmpfs rw,relatime,size=15340756k 0 0
# ...

```

--------------------------------

### List containers and tasks

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/POD_ATTACH.md

Commands to list running containers and active tasks within the k8s.io namespace.

```bash
$ ctr -n k8s.io containers ls
CONTAINER                                                           IMAGE                                            RUNTIME
07c72331fc4f2ffb7dc385beda170862f93993bd53d69232652fe1d6af83c8a8    docker.io/kindest/kindnetd:v20221004-44d545d1    io.containerd.runc.v2
33ba7bd90621cca281c99e58a83fe8fe974221085bebedc2de69ccf5988daa43    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
3bc41387a69a36fd031cdedb17aaf41a72faebce15fbad94b5e694600bde7a20    registry.k8s.io/pause:3.7                        io.containerd.runc.v2
43d816d3044000b37eed5710c2ad3da5f8f4a2e6ede47132238c0034de708612    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
44009453f6cb08fa4f617ef9b8ef5838f3dfc20c10693318b16119af4b37f7d4    registry.k8s.io/pause:3.7                        io.containerd.runc.v2
53384fe00e0a9846bfe406b4cc7ba84ba2fb34a05a86ea106064d92e648b2715    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
62ff4b5804ebb11a88af9d496afe09d2aa47fa3c0152f3ae90cf347899dcce71    docker.io/library/ubuntu:22.04                   io.containerd.runc.v2
876ef7a4f348010ce85bc6fd96ce8760c6357d7d24201b1459d8344155f4092f    docker.io/library/ubuntu:22.04                   io.containerd.runc.v2
8a8f35d4ece179d6cb968d66a1cca3dfb7dfe10b72b221cd5ff3cc42abd60c7f    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
a2036c90221e0993fb87a378b002bd43e15c1be2a70be43e7fc6416e99be4446    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
a2d0bb15f6e4b7a52d42e79685a2f57b06aa8f6ffbc15a38a1d303289a164e1d    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
bb9790ddf282fdb15c768013da80486989d4fda8f45ab94f70646cc9cce947e7    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
bdcc01c28b288e5c78e1f358716da80556b4a073c24549bc565180979c351891    registry.k8s.io/pause:3.7                        io.containerd.runc.v2
c5e3934d2e533b8580242f360f8a2e4f99a38d5cb50c9a579bf471869c38f043    gcr.io/datadoghq/agent:7.43.0                    io.containerd.runc.v2
c952cc4329ba0c822dacbade96153dea12d415c7c80ecb3f4c4a72d895629971    registry.k8s.io/kube-proxy:v1.25.3               io.containerd.runc.v2
ec74a2a48f514861096cf4b7b12550d8ce17d5b0803ec0aaf6a26dda4876e100    registry.k8s.io/pause:3.7                        io.containerd.runc.v2
f681a2a6f64b11bf53ec8d1c13de0d8715ac30819f21f94f316e0bc26a844770    registry.k8s.io/pause:3.7                        io.containerd.runc.v2
```

```bash
$ ctr -n k8s.io tasks ls
TASK                                                                PID       STATUS
839a74e97f50a275d306252842f3e79fca684a3b8b5ed3175d154fb990c80f31    51064     RUNNING
ae35055acaccc10634d9160f08937d71d856be6b0d954cc772e72c83ee9bffee    351       RUNNING
d2ff37e3f64e4032c34f635aa5d494e3d52e481772e2e8a71c5677f58938c35d    511       RUNNING
2446353ed4380ef6e81172b5c09a9191e9e300c93ded0febea42967177aae3d1    909       RUNNING
5bebdfa7f163311e44997625d4c1ac958f46ff1398925e9dbc7fb8a2ac2fc25a    12955     RUNNING
026430a39a6452201524dfbe9872b2eb6027a9bcc2085fa8f7d95096150165c0    50523     RUNNING
332f857ec069937342b07ed526e1d714b552e4656ed3e7c938b2b69c3790eb18    50895     RUNNING
24ab75252feedcf5232af1fa02a215bb0851599bc762933f7b7442943fcd58f9    50940     RUNNING
48e7c28fdc68c9473a31dea3194b922e064ad9e37499da7b7cf2481722d97dc6    401       RUNNING
80eeba17282348b418d786c6fa76338df7a7f6a6734767492825c1d6674a376a    50854     RUNNING
61250b69765dbf0fadb9cdcfa87db7c0b8c4c85ff93051f83e52574a3b4b7bd4    12922     RUNNING
ef5d38bf4bf263cbb80f0ea8cb75059e2fc997b9885d649afe0cc7d48e4f8b3f    357       RUNNING
0f36d12d60d12d041df894132882380a1175d462b654d62cc2907994cbf6c238    233924    RUNNING
ba0483c7235ccdbc9baf9f2ac0e39bea1cf54c3a16cab068c0c51954bbde99d1    233893    RUNNING
f4efb164afc51bf45cb09ed99058e72ea2e70cf887b8f8cfd5a058e69e65aa2e    1741      RUNNING
```

--------------------------------

### Get All Ingested Clusters

Source: https://github.com/datadog/kubehound/blob/main/deployments/kubehound/ui/InitialSetup.ipynb

Retrieve all ingested clusters in KubeHound, including their runID and node count. Useful for assessing cluster size and ingestion status.

```gremlin
%%gremlin -d class -g critical -le 50 -p inv,oute

kh.nodes() 
    .groupCount()
    .by(project('cluster','runID')
         .by('cluster').by('runID'))
    .unfold()
    .limit(1000)
```

--------------------------------

### Manage development stack

Source: https://github.com/datadog/kubehound/blob/main/docs/dev-guide/getting-started.md

Commands for spawning, extending, and tearing down the local KubeHound development environment.

```bash
kubehound dev --ui
```

```bash
kubehound dev --down
```

--------------------------------

### Permissions Step

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices with a "PermissionSet" label and optionally allows filtering of those vertices on the "role" property.

```APIDOC
## Permissions Step

### Description
Starts a traversal that finds all vertices with a "PermissionSet" label and optionally allows filtering of those vertices on the "role" property.

### Method
N/A (This is a traversal step, not a direct API endpoint)

### Endpoint
N/A

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
```groovy
// All permissions sets in the graph
kh.permissions()

// All permissions sets in the graph with role filter
kh.permissions("postgres-admin", "db-reader")

// All permissions sets in the graph with additional filters
kh.permissions().has("app", "web-app").limit(10)
```

### Response
#### Success Response (200)
- **Vertex** (type) - Represents a permission set in the graph.

#### Response Example
(Depends on the specific traversal and filters applied)
```

--------------------------------

### Authenticate to Kubelet API using node certificates

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/IDENTITY_ASSUME.md

Use node PKI certificates to authenticate and list pods via the Kubelet API.

```bash
 curl -k --cacert $NODE_ROOT/etc/kubernetes/pki/ca.crt --key $NODE_ROOT/var/lib/kubelet/pki/kubelet-client-current.pem --cert {$NODE_ROOT}/var/lib/kubelet/pki/kubelet-client-current.pem https://${NODE_IP}:10250/pods/ 
```

--------------------------------

### Service Accounts API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices representing service accounts and optionally allows filtering of those vertices on the "name" property.

```APIDOC
## Service Accounts API

### Description
Starts a traversal that finds all vertices representing service accounts and optionally allows filtering of those vertices on the "name" property.

### Method
GET (Implicit)

### Endpoint
/api/sas

### Parameters
#### Query Parameters
- **names** (String...) - Optional - Filters service accounts by name.

### Request Example
```groovy
kh.sas()
kh.sas("postgres-admin", "db-reader")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Service Account vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "sa-1",
      "label": "ServiceAccount",
      "properties": {
        "name": "postgres-admin"
      }
    }
  ]
}
```
```

--------------------------------

### Identities API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices with a "Identity" label and optionally allows filtering of those vertices on the "name" property.

```APIDOC
## Identities API

### Description
Starts a traversal that finds all vertices with an "Identity" label and optionally allows filtering of those vertices on the "name" property.

### Method
GET (Implicit)

### Endpoint
/api/identities

### Parameters
#### Query Parameters
- **names** (String...) - Optional - Filters identities by name.

### Request Example
```groovy
kh.identities()
kh.identities("postgres-admin", "db-reader")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Identity vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "identity-1",
      "label": "Identity",
      "properties": {
        "name": "postgres-admin"
      }
    }
  ]
}
```
```

--------------------------------

### HostMounts API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices representing volume host mounts and optionally allows filtering of those vertices on the "sourcePath" property.

```APIDOC
## HostMounts API

### Description
Starts a traversal that finds all vertices representing volume host mounts and optionally allows filtering of those vertices on the "sourcePath" property.

### Method
GET (Implicit)

### Endpoint
/api/hostMounts

### Parameters
#### Query Parameters
- **sourcePaths** (String...) - Optional - Filters host mounts by source path.

### Request Example
```groovy
kh.hostMounts()
kh.hostMounts("/", "/proc")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Host Mount vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "hostmount-1",
      "label": "HostMount",
      "properties": {
        "sourcePath": "/"
      }
    }
  ]
}
```
```

--------------------------------

### Volumes API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices with a "Volume" label and optionally allows filtering of those vertices on the "name" property.

```APIDOC
## Volumes API

### Description
Starts a traversal that finds all vertices with a "Volume" label and optionally allows filtering of those vertices on the "name" property.

### Method
GET (Implicit)

### Endpoint
/api/volumes

### Parameters
#### Query Parameters
- **names** (String...) - Optional - Filters volumes by name.

### Request Example
```groovy
kh.volumes()
kh.volumes("db-data", "proc-mount")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Volume vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "volume-1",
      "label": "Volume",
      "properties": {
        "name": "db-data"
      }
    }
  ]
}
```
```

--------------------------------

### Mount host disk

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/CE_PRIV_MOUNT.md

Create a mount point and mount the identified host disk into the container filesystem.

```bash
mkdir -p /mnt/hostfs
mount /dev/vda1 /mnt/hostfs
ls -lah /mnt/hostfs/
```

--------------------------------

### Nodes API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices with a "Node" label and optionally allows filtering of those vertices on the "name" property.

```APIDOC
## Nodes API

### Description
Starts a traversal that finds all vertices with a "Node" label and optionally allows filtering of those vertices on the "name" property.

### Method
GET (Implicit)

### Endpoint
/api/nodes

### Parameters
#### Query Parameters
- **names** (String...) - Optional - Filters nodes by name.

### Request Example
```groovy
kh.nodes()
kh.nodes("control-plane")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Node vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "node-1",
      "label": "Node",
      "properties": {
        "name": "control-plane"
      }
    }
  ]
}
```
```

--------------------------------

### Check pod creation permissions

Source: https://github.com/datadog/kubehound/blob/main/docs/reference/attacks/POD_CREATE.md

Verify if the current account has the necessary permissions to create pods using kubectl.

```bash
kubectl auth can-i create pod
```

--------------------------------

### Pods API

Source: https://github.com/datadog/kubehound/blob/main/docs/queries/dsl.md

Starts a traversal that finds all vertices with a "Pod" label and optionally allows filtering of those vertices on the "name" property.

```APIDOC
## Pods API

### Description
Starts a traversal that finds all vertices with a "Pod" label and optionally allows filtering of those vertices on the "name" property.

### Method
GET (Implicit)

### Endpoint
/api/pods

### Parameters
#### Query Parameters
- **names** (String...) - Optional - Filters pods by name.

### Request Example
```groovy
kh.pods()
kh.pods("app-pod", "sidecar-pod")
```

### Response
#### Success Response (200)
- **vertices** (Array) - An array of Pod vertices.

#### Response Example
```json
{
  "vertices": [
    {
      "id": "pod-1",
      "label": "Pod",
      "properties": {
        "name": "app-pod"
      }
    }
  ]
}
```
```