Malicious requests from private network (Kubernetes)

Solution 1:

What you see is an attack using an exploit in Apache 2.4.49 (only this version is affected). You can read more about it here CVE-2021-41773.
TLDR: Path traversal allows attacker to remotely execute code, if files are not protected by require all denied configuration.

If you are using any Apache servers upgrade those to, at least, version 2.4.50.
Execute this on your Apache server

curl --data "echo;id" 'http://127.0.0.1:80/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh'

If that returns anything other than a 403 error, your server may be vulnerable.

Assuming you are using DigitalOcean - check your account activity, and your team activity, for actions droplet.create and droplet.destroy with suspocious IP.

Check your kube scheduler and controller logs for any suspicious activity.