Kubernetes for Red Teamers

This class is built for security professionals with advanced-beginner to intermediate technical experience. You should be comfortable with the command-line interface (CLI) and basic networking concepts.

You do not need to be a Kubernetes administrator before taking this class. Some Kubernetes familiarity will help, but the course introduces the concepts needed for the labs as they become relevant. If you already have deep Kubernetes security experience, some sections may feel foundational, but the course should still be useful as a practical, end-to-end attack-path exercise.

How to use this course

This is Part 1 of a two-part class with each class intended to be less than an 8-hour training block after the lab environment is ready. It is not a general Kubernetes administration course, and it is not a catalog of every possible container escape or cluster takeover technique. It is a guided path through a singular attack path.

Each lab is structured around three pieces:

1. Core concepts: the Kubernetes and security ideas needed for the lab
2. Hands-on lab: the scenario where you apply those ideas
3. Walkthrough: a step-by-step guide if you get stuck or want to compare your reasoning

Use the walkthroughs as support, not as the point of the course. The most valuable part of the training is learning to ask better questions as your perspective changes: Who am I? What can I do? What layer am I observing from? What did Kubernetes assemble for this workload? Which control would have stopped this?

What you will work through

The course begins by getting the local lab running and orienting you to the environment, initial access into the environment, and some basics on how to interact with the cluster. From there, the labs follow one connected attack path:

• Start from ceded access in a Kubernetes environment
• Perform situational awareness against the cluster and your current identity
• Use RBAC and workload details to identify a path into a more useful pod context
• Pivot through service account access and namespace permissions
• Evaluate insecure cluster defaults
• Build and deploy a containerized payload
• Use a privileged workload to privilege escalate in the cluster
• Inspect other containers running on the same virtual machine (VM)
• Interpret environment variables, mounts, projected material, and live filesystem state from running containers

The larger themes are authentication, RBAC, workloads as attack surfaces, architecture and trust boundaries, and node/runtime security. If those terms do not all make sense yet, that is fine. The course will cover these concepts as you move through the labs.

Student requirements

• Knowledge - This course assumes basic familiarity with Kubernetes concepts, Linux, and the command line. No prior Kubernetes security experience is required, but students should already be comfortable with core ideas such as pods, namespaces, manifests, and interacting with a cluster through kubectl.
• Hardware - This course lab runs locally as a four VM Vagrant environment: one control plane node, two worker nodes, and one teamserver. The lab allocates 8 vCPUs and approximately 16 GB of RAM across those virtual machines, so students should use a computer that supports hardware virtualization and has enough headroom to run the environment comfortably. A system with at least 8 CPU cores and 16 GB of memory is the practical minimum; 32 GB of memory is recommended for a smoother experience. Students will also need stable internet access for provisioning and enough free disk space for the base boxes, container images, and lab artifacts.