The best way to defend a Kubernetes cluster is to understand how attackers think.

Have you ever read dozens of Kubernetes security articles but still wondered:

• Is my Kubernetes cluster actually secure?

• Would I recognize a real attack if it happened?

• Do I know how to fix security issues—not just identify them?

That was exactly the motivation behind this project.

Instead of another theory-heavy tutorial, this hands-on lab lets you attack a vulnerable Kubernetes cluster, secure it yourself, and verify your solution automatically.

The entire learning experience is built around the OWASP Kubernetes Top 10 (2025), helping you develop practical security skills that can be applied to real production environments.

Why Traditional Kubernetes Security Learning Falls Short

Most Kubernetes security resources focus on concepts such as:

• RBAC

• NetworkPolicy

• Secrets

• Admission Controllers

• Audit Logging

These are all essential topics, but many engineers struggle because they rarely experience what these security controls are actually protecting against.

Reading documentation explains what to configure.

Experiencing an attack explains why it matters.

Once you've exploited a vulnerability yourself, the purpose of the security control becomes immediately obvious.

That is the learning philosophy behind this project.

The Scenario: Welcome to NimbusMart

Imagine you've joined the Red Team of a fictional e-commerce company called NimbusMart.

The company's Kubernetes cluster contains multiple security weaknesses.

Your mission is simple:

1. Discover the vulnerability.

2. Exploit it.

3. Capture the flag.

4. Harden the configuration.

5. Verify that your fix works.

Rather than memorizing security checklists, you'll experience the complete cycle of offensive and defensive Kubernetes security.

The 10 Security Missions

Each mission focuses on one risk from the OWASP Kubernetes Top 10 (2025).

Each mission represents a realistic security challenge that Kubernetes administrators encounter in production.

Example Mission: K02 – Authorization

Let's walk through one mission.

Step 1. Understand the Vulnerability

Start by reading the mission briefing.

You'll learn:

• What the vulnerability is

• Why it is dangerous

• How attackers exploit it

Rather than following instructions blindly, you'll begin thinking like an attacker.

Step 2. Exploit the Cluster

Deploy the vulnerable environment.

You'll discover a ServiceAccount with excessive RBAC permissions.

Using the provided attack scripts, you'll exploit those permissions and retrieve the mission flag.

This quickly demonstrates why overly permissive RBAC rules remain one of the most common Kubernetes security mistakes.

Step 3. Become the Defender

Now switch perspectives.

Apply the Principle of Least Privilege by updating the Kubernetes manifests.

Replace overly broad permissions with narrowly scoped:

• Role

• RoleBinding

Grant only the permissions that the workload actually needs.

Step 4. Verify Automatically

Every mission includes an automated validation tool.

Simply run:

./check.sh

You'll immediately receive feedback:

Passed ✅

or

Failed ❌

This instant verification helps you learn much faster because you always know whether your solution satisfies the security requirements.

Prerequisites

Before getting started, make sure Docker is installed on your machine.

That's all you need.

There's no need to manually create a Kubernetes cluster or install additional tools like Minikube, kind, or Helm. The setup script automatically provisions everything required for the lab.

Getting Started in Minutes

One of the biggest barriers to learning Kubernetes security is setting up a realistic lab environment.

This project removes that friction.

As long as Docker is installed, you're just one command away from launching the complete hands-on lab.

Deploy everything with:

./setup.sh

The script automatically provisions:

• a vulnerable Kubernetes environment

• the web interface

• all ten security missions

Once the deployment is complete, open your browser and navigate to:

http://localhost:30090

From there, you can start solving the security missions one by one.

Learn by Comparing Vulnerable and Secure Configurations

Each mission contains two versions of the Kubernetes manifests:

labs/
   K01/
      vulnerable.yaml
      fixed.yaml

Comparing these files side by side is one of the most effective ways to learn.

Instead of reading abstract documentation, you can immediately see:

• what made the workload vulnerable,

• how the secure configuration differs,

• and why the fix works.

Understanding security through comparison often creates deeper learning than memorizing best practices.

Insight: The Fastest Way to Remember Security Is to Break It First

Many engineers try to memorize Kubernetes security recommendations.

A more effective approach is to experience the consequences yourself.

When you've personally:

• escalated privileges,

• accessed secrets,

• bypassed insecure configurations,

• and then prevented those same attacks through proper hardening,

security stops being a checklist and becomes intuition.

That's the real value of hands-on learning.

You no longer remember a rule because someone told you to follow it—you remember it because you've seen exactly what happens when it's ignored.

Final Thoughts

Kubernetes security isn't just about applying YAML templates or passing compliance audits.

It's about understanding how real attackers think—and building defenses that stop them.

By combining offensive exercises, defensive remediation, and automated validation, this project offers a practical path toward mastering Kubernetes security.

Whether you're preparing for a DevSecOps role, a cloud security certification, or simply want to operate more secure Kubernetes clusters, these ten hands-on missions will give you experience that documentation alone cannot provide.

Remember:

The strongest defense begins with understanding the attack.

Happy hacking—and happy hardening! 🔐

Ref: https://github.com/hac01/Owasp-top-10-k8s-2025/tree/main/labs