Google's Kubernetes (aka k8s) has become the de facto standard for software container orchestration. As development teams have rapidly embraced it, the Kubernetes feature set has exploded, and the importance of securing the Kubernetes ecosystem has become the focal point. During our discussions with people moving toward the container-based ecosystem, we realized that the major concerns raised at the center of the cloud - the orchestrator. Especially since Kubernetes has become the most popular orchestrator in practice, how to secure Kubernetes becomes an open question to the security community. However, no work provides a comprehensive study of these issues. Questions like "how severe could the effects of k8s vulnerabilities be?", "how hard is it to configure the system correctly and securely?", or "Is there a tool that can help me out?" are the most common ones DevOps teams will ask. To conquer these challenges, we have performed a systematic study on k8s orchestration from the security perspective. We will give a short but comprehensive view of existing k8s vulnerabilities, as well as those newly discovered by us, to give people a deep and broad view of k8s security. Then, we'll focus on new research to show how attackers are able to launch an attack in the cloud-native container system, not focusing on an individual exploit or vulnerability. In particular, we spotlight how attackers perform lateral movement within the container environment and analyze how such an attack is performed with the help of vulnerabilities and a mis-configured orchestrator. More importantly, we will demonstrate our K8s security tool, AbnormalK8s, which detects not only the exploits on vulnerable K8s servers but also the abnormal network input against the mis-configured orchestrator. It leverages a combination of machine learning and rules-based detection strategies to profile orchestrator behavior.