About
In this module of the Cloud Security Engineer learning path, you practice Kubernetes orchestration security by assessing a simulated cluster for RBAC misconfigurations, secret exposure, and privileged container escape. The lab runs a mock Kubernetes API that speaks kubectl-compatible JSON, so every command uses curl against the cluster endpoint. No real Kubernetes cluster or kubectl binary is required. The environment mirrors what pentesters find in misconfigured clusters: default service accounts bound to cluster-admin, secrets readable without scoped RBAC, and pod creation policies that allow privileged containers with host filesystem mounts. Upon completion of the module, students will be able to: • Enumerate Kubernetes namespaces, pods, secrets, and RBAC bindings using the API • Identify overly permissive ClusterRoleBindings (default SA to cluster-admin) • Extract secrets from namespaces that should be restricted • Create a privileged pod with a hostPath volume mount to simulate container escape • Prescribe mitigations for each finding (scoped RBAC, PodSecurity admission, namespace isolation) For course inquiries, visit https://www.darkrelay.com/cybersecurity-course-inquiry