Lion Cipher Lab
Lock down a Kubernetes cluster with RBAC: give a workload exactly the permissions it needs
- Cloud Security
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Kubernetes is how a huge share of modern software gets run, and the single most common security finding in a real cluster is not a missing patch — it is a workload that was handed far more permission than it needs, usually because someone in a hurry gave it `admin` or `cluster-admin` and moved on. When an attacker compromises that container (through a vulnerable dependency, a leaked token, a supply-chain package) they do not get 'a container' — they inherit whatever that workload was allowed to ask the Kubernetes API for. RBAC is the layer that decides that, and it is the difference between a…
What you'll learn
- Kubernetes RBAC
- least privilege for workloads
- ServiceAccount design
- reading and writing Kubernetes YAML
- authorization testing with kubectl auth can-i
- spotting privilege-escalation paths in a cluster
Steps in this lab
- The vocabulary, from absolute zero
- Build a throwaway cluster with kind
- The four-way model: Role, ClusterRole, RoleBinding, ClusterRoleBinding
- Create a namespace and a ServiceAccount — then prove it can do nothing
- Grant exactly one permission — a Role and a RoleBinding
- See it from inside a Pod — the attacker's view
- Audit an existing cluster: who can do what, and who is cluster-admin
- The judgment: which permissions are secretly cluster-admin, and what RBAC will never do for you