github.com/inguardians/peirates

• bumped oauth version to correct CVE-2025-22868
• fixed static compilation
• renamed menu items for ease

• added option to ignore TLS checking on API server requests
• added tab completion to switch namespaces
• updated AWS IMDSv2 handling

• updated to detect microk8s kubelet kubeconfig location
• now handles case where kubelet config does not contain client key
• removed use of external JWT library
• updated golang modules to eliminate CVEs

• bugfix for cloud detection panic

• removed external dependency for JWT decoding
• fixed azure detection
• improved kubelet config parsing for AKS
• allow decode-jwt to be called from main menu

• Added a feature to display the values of stored service account tokens
• Added a verbose (-v) flag to display additional DEBUG messages.
• Updated upstream libraries to handle vulnerabilities found in dependencies: CVE-2023-39325, CVE-2023-44487, CVE-2023-3978

• Added cloud provider detection from @devsecfranklin
• Bump gopkg.in/yaml.v3 to avoid DoS risk on filesystem
• Added a function to get eth0 IP addr and put in banner
• Parse the current pod's service account name from its JWT
• Cleaned up menu formatting

• Added a second variation of kubectl-try-all that tries a command as every service account collected, no longer stopping on the first success. (Idea from @Malachi-the-Ninja)

Added image building and K8S deployment functions from @devsecfranklin Improved error handling on CoreDNS wildcard trick Added another kubelet kubeconfig file path and handled errors better Added a credits.md file and added a developer to it: @devsecfranklin

• fixed kubelet cert/key pulling code to handle kubelet kubeconfig files with embedded user cert/key pairs
• updated kubeconfig file parsing to parse via the YAML library, which is much more resilient

• Updated recovering service account tokens from the node filesystem to handle the ServiceAccount admission controller

• added feature to better name secrets found on node using the pod's etc-hosts file
• we now avoid adding duplicate service accounts from the kubelet secret gathering
• shell command takes multiple commands

• refactored curl feature
• made a bugfix to using node certs

• added quick commands for switching service accounts and namespace, without having to navigate submenus
• bugfix - kubectl logic had dropped namespace context

• added a kubectl-try-all feature - tries every service account and client cert that peirates has gathered it has until it finds one that can do the command.

• execute shell commands from the main menu via "shell [args]"
• execute kubectl commands from the menu via "kubectl [args]"
• kubectl no longer locks you to namespace context - can be overridden with -n or --all-namespaces