Preserve Kubernetes escalation content and historical heading URLs

[carlospolop]

Repair of closed PR #481: historical heading URLs

PR #481 was closed because the candidate lost preexisting heading URLs. I compared the rendered mdBook HTML IDs for every modified existing Kubernetes/OpenShift page at merge base 47bb6e8f32 with this branch. The prior head lacked 42 IDs in nine original pages. This branch restores all 42 at their original URLs: 40 moved sections now have a compatibility heading and exact destination link; two old title aliases are restored next to the original page titles. The rendered comparison now reports zero missing old IDs. This directly repairs the reviewer finding; the moved executable content remains on the destination pages.

The affected original pages are Kubernetes namespace and cloud pivoting, API object operations, External Secrets Operator, Kyverno overview and bypass, OPA Gatekeeper overview and bypass, and OpenShift SCC.

Concrete repairs in this branch

This PR changes 39 Kubernetes/OpenShift Markdown files. It moves the writeups and their command blocks to pages that describe their actual effect. Old headings stay as pointers where an existing link might target them. The table names the content moved, its destination, and the identity or permission boundary used to decide placement.

Original page or section	Repair at this head
kubernetes-privilege-escalation/api-object-operations.md	Moved the Pod, ServiceAccount, Role/RoleBinding, and token-Secret API request examples intact to new kubernetes-basic-information/api-object-operations.md; the old page is an inbound pointer. These are API syntax examples, not a gain by themselves.
kubernetes-privilege-escalation/rbac-and-identities.md wildcard access explanations	Moved Access Any Resource or Verb and Access Any Resource with a specific verb to kubernetes-basic-information/access-and-common-concepts.md; retained bind, escalate, impersonation and the concrete aggregated-ClusterRole path in privilege escalation.
kubernetes-privilege-escalation/validating-admission-policies.md definition, purpose, enumeration and native CEL overview	Moved their full examples to new kubernetes-basic-information/admission-policy-objects.md; retained headings on the old page as links. Concrete admission-policy weakening and MutatingAdmissionPolicy code injection remain in privilege escalation.
Kyverno and OPA Gatekeeper introduction pages under kubernetes-privilege-escalation/kyverno/ and .../opa-gatekeeper/	Moved definitions and example policies to new kubernetes-basic-information/kyverno.md and opa-gatekeeper.md. The old README.md files point there.
Kyverno and OPA Gatekeeper bypass examples under those privilege-escalation subdirectories	Moved the misconfiguration, excluded-namespace, and webhook-bypass walkthroughs to new kubernetes-post-exploitation/kyverno-bypass.md and opa-gatekeeper-bypass.md. Old pages retain pointers; writable policy/constraint paths remain documented in privilege escalation.
validating-admission-policies.md tested mutation controls, authorizer match conditions, parameter-object cases and fail-open backend tests	Moved their full examples to new kubernetes-post-exploitation/admission-control-bypass.md. The privilege-escalation page retains the specific headings and pointers, so a reader can distinguish a possible admission bypass from an already-proven identity gain.
kubernetes-privilege-escalation/external-secrets-operator.md	Moved the ExternalSecret/ClusterSecretStore data-copy walkthrough intact to new kubernetes-post-exploitation/external-secrets-operator.md; the old page links to it. An ExternalSecret value alone does not identify a credential subject.
controllers-and-admission.md, storage-and-networking.md, and secrets-and-configmaps.md generic controller/data/network effects	Moved operator confused-deputy data reads, cross-namespace reference data, VolumeSnapshot copying, services/status traffic interception, DRA device examples, ConfigMap live poisoning and CoreDNS redirection to new kubernetes-post-exploitation/controller-data-and-network-effects.md. Original headings point to their exact destination. Controller paths that run code as a named workload identity stay in privilege escalation.
kubernetes-privilege-escalation/secrets-and-configmaps.md generic Secret enumeration and legacy token-name guessing	Moved the complete command examples to new kubernetes-post-exploitation/secrets-and-configmaps.md#secret-listing-and-data-inspection and #legacy-token-secret-name-guessing. The original page keeps the verified legacy ServiceAccount-token path and manually created token-Secret path.
Argo CD cluster Secret example in that page	Kept its full token-recovery and kubectl auth whoami proof in kubernetes-privilege-escalation/secrets-and-configmaps.md#argo-cd-managed-cluster-credentials; the post-exploitation Argo heading points back. It claims an identity gain only after a usable credential and exact managed-cluster subject are verified, not from the Secret label.
GKE RoleBinding example in that page	Kept its full example at #escalating-in-gke. It now requires the caller to control the bound Google subject and show newly effective Kubernetes RBAC permissions. The post-exploitation heading points back. The operation is Kubernetes RoleBinding create/bind, not a GCP container.* grant.
kubernetes-post-exploitation/kubernetes-pivoting-to-clouds.md workload-to-cloud identity paths	Moved the specific GKE Workload Identity, EKS IRSA, EKS Pod Identity, AKS workload identity, and node/cloud role acquisition writeups to new kubernetes-privilege-escalation/kubernetes-pivoting-to-clouds.md. Kept cloud-to-cluster verification, generic GKE setup, node-pool configuration, EKS guardrails and discovery commands on the post-exploitation page.
Static Google service-account key and Kiam/Kube2IAM role annotations	Kept the full Secret-to-verified-Google-principal and Pod-to-exact-IAM-role examples on the new privilege-escalation cloud page. Each now names the usable key or running metadata proxy/trust checks needed to claim the target. The post-exploitation headings link to those exact sections.
kubernetes-post-exploitation/kubernetes-namespace-escalation.md identity-bearing cross-namespace and cloud trust sections	Moved them to new kubernetes-privilege-escalation/kubernetes-namespace-escalation.md; moved the generic binding review command to kubernetes-enumeration/rbac-objects.md. The former page keeps namespace-isolation discussion and pointers.
kubernetes-post-exploitation/node-post-exploitation.md exact control-plane credential artifacts	Moved the identity-bearing artifact checks to kubernetes-privilege-escalation/node-permissions-and-status.md#control-plane-node-artifacts. Generic node effects remain in post exploitation.
kubernetes-post-exploitation/attacking-kubernetes-from-inside-a-pod.md runtime socket/kernel helper access and kubernetes-privilege-escalation/workload-and-pod-access.md SUID planting	Put the runtime path that yields node authority on the privilege-escalation page; moved the SUID planting example, which depends on later host execution, to post exploitation. Both old locations point to the destination.
kubernetes-persistence/identities-and-rbac.md aggregated ClusterRole self-grant	Added the direct privilege-escalation section at kubernetes-privilege-escalation/rbac-and-identities.md#bindings-and-aggregated-clusterroles, with a pointer from persistence.
openshift-pentesting/openshift-scc.md	Split SCC definition/listing from using an SCC to run an admitted host-access Pod. The executable privilege path is now openshift-privilege-escalation/openshift-scc.md#use-scc; the overview links to it.

| kubernetes-privilege-escalation/storage-and-networking.md host log symlink file reads | Moved the full file-read walkthrough and its code blocks to kubernetes-post-exploitation/node-post-exploitation.md#host-log-symlink-file-reads. The old heading points there; hostPath permission paths remain in privilege escalation. A host file read alone has no exact credential subject. |
| kubernetes-privilege-escalation/node-permissions-and-status.md legacy status/controller effects | Moved the full reproduced effects table to kubernetes-post-exploitation/controller-data-and-network-effects.md#legacy-status-metadata-and-controller-deputies. The old heading points there. Pending-Pod scheduling and namespace PSA permission paths remain in privilege escalation. |
| openshift-privilege-escalation/openshift-scc-bypass.md custom labels and namespace label listing | Moved label/automation context and the enumeration command to openshift-basic-information.md#custom-labels-and-automation and #list-namespaces-with-the-run-level-label; old headings point to them. Neither the generic custom-label case nor listing establishes a new principal. |
| kubernetes-privilege-escalation/rbac-and-identities.md non-escalating RBAC explanations | Moved the /debug/* and /metrics read commands to kubernetes-enumeration/rbac-objects.md#diagnostic-non-resource-urls; moved built-in escalation-prevention rules and binding writes without bind to kubernetes-basic-information/access-and-common-concepts.md. The old headings are exact pointers; the actual bind and escalate techniques remain on the privilege-escalation page. |
| kubernetes-privilege-escalation/workload-and-pod-access.md Stealth and port-forward | Moved the Pod security-mode comparison to kubernetes-basic-information/access-and-common-concepts.md#pod-security-mode-effects, and the full kubectl port-forward example to kubernetes-post-exploitation/attacking-kubernetes-from-inside-a-pod.md#podsportforward-network-access. Old headings are pointers. Neither section alone supplies a new identity or permission. |

src/SUMMARY.md registers the new basic-information, post-exploitation and privilege-escalation pages. Enumeration links, the privilege-escalation hub and the Kubernetes persistence page now point to the destination sections. Moved sections retain their original source citations or direct source links.

Checks at head 53a9c98481

• Full mdbook build passed again after restoring the 42 heading IDs. The base version was also built to compare actual rendered IDs page by page. All preexisting rendered IDs on modified existing pages are present at this head.
• All 40 new moved-section links resolve to a rendered destination page and anchor; the two restored title aliases retain their original URLs.
• Full mdbook build passed. I made the unavailable tabs preprocessor optional only during the local build and restored book.toml afterward.
• Compared fenced blocks from the merge base across all 39 changed Markdown pages: all 212 pre-existing blocks are still present verbatim after relocation.
• All 2,071 local relative links in changed Markdown resolve, and numbered citation markers on those pages have corresponding references.
• Rebuilt mdBook at this PR head with the unavailable tabs preprocessor marked optional through an environment override. All 72 active and 221 excluded companion Blue-CloudPEASS source references resolve against the fresh rendered HTML, including all four newly activated exact-evidence variants (Argo CD remote credential, static Google key, GKE RBAC self-grant, Kiam/Kube2IAM role). One exclusion cites a page without an anchor; that page exists.
• The companion ledger has a row for each of 422 headings across 50 in-scope Kubernetes/OpenShift pages at this PR head; its focused tests passed (20 passed, 1 skipped); the current-head ledger check separately confirms 422/422 headings.
• git diff --check passed. No book.toml change is committed.

[carlospolop]

Decision: keep

The material contribution is a clearer location for existing techniques, not a claim of a new technique. Kubernetes RBAC and admission documentation support the distinction between an available operation and a demonstrated privilege gain. The review repaired misplaced navigation entries, indirect links, cross-page citations, duplicate reference URLs, and two broken image paths. Static chec…

Head: 2142b201eee90c54c69e10f187495b712a724999

[carlospolop]

merge