i worked on an osquery extension once that used the kubelet HTTP API so that if you could deploy osquery as a daemon set, you could query each kubelet via the local osquery. ymmv, it may or may not work in all environments as some providers (like GKE) block access to the kubelet API from pods.