Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API)

An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components. 
Container API
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1552/007  external_id: T1552.007     source_name: Unit 42 Unsecured Docker Daemons  description: Chen, J.. (2020, January 29). Attacker's Tactics and Techniques in Unsecured Docker Daemons Revealed. Retrieved March 31, 2021.  url: https://unit42.paloaltonetworks.com/attackers-tactics-and-techniques-in-unsecured-docker-daemons-revealed/     source_name: Docker API  description: Docker. (n.d.). Docker Engine API v1.41 Reference. Retrieved March 31, 2021.  url: https://docs.docker.com/engine/api/v1.41/     source_name: Kubernetes API  description: The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.  url: https://kubernetes.io/docs/concepts/overview/kubernetes-api/     