> ## Content Index
> Fetch the complete content index at: https://www.ostering.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Orchestration (OR)

- URL: /taxonomies/software-factory/orchestration/
- Published: 2026-10-31T13:00:00.000Z
- Updated: 2026-10-29T12:55:38.917Z
- Description: Orchestration (OR): 13 threats in the software factory threat taxonomy. Kubernetes API, RBAC, admission, operators, Helm, nodes, cluster networking.
- Author: Brett Crawley

[Taxonomies](/taxonomies/) › [Software factory](/taxonomies/software-factory/) › Orchestration

**Station 16 of 17 · Line 2, Artifact to Runtime · 13 threats · prefix OR**

The orchestrator's API is a remote shell on every node for whoever holds the right role. These cards cover the Kubernetes API, RBAC, admission, operators and Helm, nodes and cluster networking.

**Scope:** Kubernetes API, RBAC, admission, operators, Helm, nodes, cluster networking.

![Table: Orchestration (OR), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/119/taxonomy-table-16-OR.png =1400x4617)

*Text version: every entry on this page is in the [PDF and Excel downloads](/taxonomies/software-factory/) on the overview page, where it can be searched and copied.*

## The threats

- <span id="or-a"></span>**OR·A** Exposed Control Plane
- <span id="or-k"></span>**OR·K** Over-Broad RBAC
- <span id="or-q"></span>**OR·Q** Admission Webhook Compromise
- <span id="or-j"></span>**OR·J** Admission Policy Absent
- <span id="or-10"></span>**OR·10** Cluster Secrets Exposure
- <span id="or-9"></span>**OR·9** Operator Privilege
- <span id="or-8"></span>**OR·8** Hostile Chart or Manifest
- <span id="or-7"></span>**OR·7** Flat Cluster Network
- <span id="or-6"></span>**OR·6** Namespace as Tenant Boundary
- <span id="or-5"></span>**OR·5** Node to Cluster Escalation
- <span id="or-4"></span>**OR·4** Service Account Token Abuse
- <span id="or-3"></span>**OR·3** Audit Logging Gap
- <span id="or-2"></span>**OR·2** Version Lag

## Where this station touches others

- **Orchestration and Delivery and Deployment:** orchestration is the cluster that runs workloads; delivery is the path that puts them there.

## Seen in the wild

- **OR·A Exposed Control Plane:** Tesla Kubernetes console (2018).
- **OR·Q Admission Webhook Compromise:** IngressNightmare, CVE-2025-1974 (2025).

Sources for each case are listed on the [overview page](/taxonomies/software-factory/).

## STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 12 cleanly and 1 only loosely. CAPEC 3.9 has a pattern that describes 2 of them directly, only a generic parent pattern for 10, and nothing for 1. CWE 4.20 names the weakness directly for 9, has only a broader weakness for 4,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in [Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE](/mapping-the-software-factory-threat-taxonomy/). The Excel, SKOS and STIX downloads carry the same mapping as text.

![Table: STRIDE, CAPEC and CWE mapping for Orchestration (OR), 13 threats, with each entry's STRIDE categories and fit, CAPEC 3.9 patterns and CWE 4.20 weaknesses. The full mapping is in the Excel, SKOS and STIX downloads on the software factory taxonomy overview page.](https://www.ostering.com/media/posts/119/software-factory-mapping-table-16-OR.png =1400x2070)

---

← [Container Runtime (RT)](/taxonomies/software-factory/container-runtime/) · [Software factory overview](/taxonomies/software-factory/) · [Delivery and Deployment (DL)](/taxonomies/software-factory/delivery-and-deployment/) →

*© 2026 Jonathan Brett Crawley. Licensed under [CC BY-NC-ND 4.0](https://creativecommons.org/licenses/by-nc-nd/4.0/) with additional permissions: see the licence on the [software factory overview](/taxonomies/software-factory/).*