--- title: "Honeypods: Applying a Traditional Blue Team Technique to Kubernetes" source: "https://www.tigera.io/blog/honeypods-applying-a-traditional-blue-team-technique-to-kubernetes/" --- [Technical Blog](https://www.tigera.io/category/technical-blog/) # Honeypods: Applying a Traditional Blue Team Technique to Kubernetes By [Garwood Pang](https://www.tigera.io/blog/author/garwood/) on Mar 17, 2021 • 3 min read ## Traditional honeypots The use of honeypots in an IT network is a well-known technique to detect bad actors within your network and gain insight into what they are doing. By exposing simulated or intentionally vulnerable applications in your network and monitoring for access, they act as a canary to notify the blue team of the intrusion and stall the attacker’s progress from reaching actual sensitive applications and data. Once the blue team is aware of the situation, the attack can be traced back to the initial vector. The attack can then be contained and removed from the network. Applying this technique into a Kubernetes environment works exceedingly well because of the declarative nature of applying manifests to deploy workloads. Whether the cluster is standalone or part of a complex pipeline, workload communications are defined by the application’s code. Any communication that’s not defined can be deemed suspicious at minimum and indicate that the source resource may have been compromised. By introducing fake workloads and services around production workloads, when a workload is compromised, the attacker cannot differentiate between other real and fake workloads. The asymmetric knowledge between the attacker and the cluster operator makes it easy to detect lateral movements from compromised workloads. ![Honeypots](https://www.tigera.io/app/uploads/2021/03/Honeypod-Research.png) ## Honeypods Honey**pods** in Calico Cloud and Calico Enterprise make use of this concept to provide a supplementary detection method when strict network policies or monitoring are not feasible. Honeypods work by deploying canary workloads and services in sensitive namespaces and monitoring them for access. By leveraging the monitoring and alerting capabilities in Calico Cloud and Calico Enterprise, any connections made to these canary workloads will generate an alert and can be traced back to the source. Canary traffic can also be inspected using a DPI engine to provide signature-based detection that delivers high-fidelity alerts and significantly reduces false positives. Honeypods can be used to detect attacks including: - Data exfiltration - Resources enumeration - Privilege escalation - Denial of service (DoS) - Vulnerability exploitation attempts Tigera provides a set of sample honeypods, and instructions on how to deploy them into your cluster. [Learn more: https://docs.tigera.io/threat/honeypod/honeypods](https://docs.tigera.io/calico-enterprise/threat/honeypods) Honeypods can also be monitored to detect and confirm known threats by leveraging the dynamic packet capture feature included with Calico Cloud and Calico enterprise, as well as with Intrusion Detection System (Snort) signatures: [Learn more: https://docs.tigera.io/threat/honeypod/honeypod-controller](https://docs.tigera.io/calico-enterprise/threat/honeypods) **[Want to learn more? Get started with a free Calico Cloud trial.](https://www.calicocloud.io/)**   [Products](https://www.tigera.io/tags/products/) ## Related posts [![Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/app/uploads/2026/09/Meet-Mylo-An-AI-native-way-to-work-with-Calico.png)](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) #### [Meet Mylo: An AI-native way to work with Calico](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) By [Phil DiCorpo](https://www.tigera.io/blog/author/phil-dicorpo/) on Sep 3, 2026 A library of Calico tools and skills — delivered through the Calico MCP Server What if your hardest network question took ten minutes instead of ten days? Anyone who has operated Kubernetes networking at scale... [Read more](https://www.tigera.io/blog/meet-mylo-an-ai-native-way-to-work-with-calico/) [![The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/app/uploads/2026/08/The-Safest-Place-to-Run-an-AI-Agent-Is-On-a-Cluster-That-Doesnt-Trust-It.png)](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) #### [The Safest Place to Run an AI Agent Is On a Cluster That Doesn’t Trust It](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 27, 2026 Every organization running AI agents has already made a hosting decision. Most made it by accident. The sales team switched on the agent built into their CRM. Engineering is piloting a coding agent in a... [Read more](https://www.tigera.io/blog/the-safest-place-to-run-an-ai-agent-is-on-a-cluster-that-doesnt-trust-it/) [![AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/app/uploads/2026/08/AI-Red-Team-Agents-Automate-Attacks-on-your-AI-Agents.-Runtime-Policies-Automate-their-Defense.png)](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) #### [AI Red Team Agents Automate Attacks on your AI Agents. Runtime Policies Automate their Defense.](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/) By [Alister Baroi](https://www.tigera.io/blog/author/alister-baroi/) on Aug 24, 2026 The AI red teaming market grew up fast this year. OpenAI bought Promptfoo, Cisco and Microsoft shipped automated attack suites, and a seed-stage startup publicly compromised 50 of 55 live customer service bots. These platforms... [Read more](https://www.tigera.io/blog/ai-red-team-agents-automate-attacks-on-your-ai-agents-runtime-policies-automate-their-defense/)