Lab 05 — Kubernetes Identity Audit

Mission Information

Item	Details
Lab ID	K8S-IAM-LAB-05
Difficulty	Advanced
Estimated Time	3–4 Hours
Environment	Kubernetes Cluster (Amazon EKS / Azure AKS / Google GKE / kind)
Platform	Kubernetes
Cost	Free (kind) / Cloud Charges Apply
Primary Role	Kubernetes Security Engineer
Module	Module 02 — Kubernetes Identity & Access Management
Previous Lab	Lab 04 — Secure Kubernetes Authentication with OIDC & IAM Roles for Service Accounts (IRSA)

Mission Scenario

CloudNova Technologies has completed the migration of hundreds of applications to Kubernetes.

The Kubernetes platform has evolved over several years, and multiple engineering teams have independently created:

Service Accounts
Roles
ClusterRoles
RoleBindings
ClusterRoleBindings
IAM Roles
OIDC Integrations

During an internal audit, several concerns were raised:

Excessive cluster-admin assignments
Shared Service Accounts
Unused Roles
Wildcard permissions
Default Service Accounts in production
Missing namespace isolation
Stale RBAC objects
Missing workload identity governance

The Chief Information Security Officer (CISO) has requested a full Kubernetes Identity Audit before the next compliance review.

As the Kubernetes Security Engineer, you must assess the environment, identify security risks, document findings, and recommend improvements.

Learning Objectives

By completing this lab, you will learn how to:

Audit Kubernetes identities
Review Service Accounts
Assess RBAC implementation
Review ClusterRoles
Audit RoleBindings
Audit ClusterRoleBindings
Review workload authentication
Assess IRSA implementation
Detect excessive permissions
Identify orphaned identities
Evaluate least privilege
Produce an enterprise identity audit report

Enterprise Architecture

                     CloudNova Kubernetes Platform

                     Kubernetes API Server
                              │
                    Authentication & OIDC
                              │
                    Authorization (RBAC)
                              │
       ┌───────────────┬───────────────┬───────────────┐
       │               │               │
 Service Accounts   Human Users     Cloud Identities
       │               │               │
       └───────────────┼───────────────┘
                       │
                Kubernetes Resources
                       │
                 Identity Audit Review

Lab Outcomes

By the end of this lab you will have:

Audited all Service Accounts
Reviewed RBAC implementation
Identified privileged identities
Reviewed authentication mechanisms
Audited workload identities
Assessed least privilege
Reviewed cloud identity integration
Produced an enterprise identity audit report

Prerequisites

Before starting:

Complete Module 01
Complete Module 02 Labs 01–04
Kubernetes cluster running
kubectl installed
AWS CLI (for IRSA validation, if applicable)

Tools Used

Tool	Purpose
kubectl	Kubernetes administration
Docker Desktop	Local cluster runtime
kind	Local Kubernetes
AWS CLI	IRSA validation
Visual Studio Code	YAML review
PowerShell / Git Bash	Command execution

Mission Objectives

Perform a complete identity assessment covering:

Service Accounts
Authentication
RBAC
Roles
ClusterRoles
Bindings
Workload Identity
OIDC
IRSA
Least Privilege
Governance

Task 01 — Verify Cluster Health

Verify cluster connectivity.

kubectl cluster-info

kubectl get nodes

Confirm:

Cluster accessible
Nodes Ready

Task 02 — Inventory All Service Accounts

List every Service Account.

kubectl get serviceaccounts -A

Review:

Namespace
Age
Naming convention

Document:

Total Service Accounts
Default Service Accounts
Application Service Accounts
Administrative Service Accounts

Task 03 — Review Default Service Accounts

Inspect every default Service Account.

kubectl describe sa default -n <namespace>

Review:

Token mounting
Usage
Workloads attached

Questions:

Is the default Service Account used by production workloads?
Should dedicated Service Accounts replace it?

Task 04 — Audit Service Account Tokens

Review authentication tokens.

kubectl get secrets -A

Review projected tokens.

Inspect Pods.

kubectl describe pod <pod-name>

Confirm:

Projected tokens
Legacy tokens
Token mounting

Task 05 — Review Roles

Inventory Roles.

kubectl get roles -A

Inspect each Role.

kubectl describe role <role> -n <namespace>

Review:

Resources
Verbs
API Groups

Identify:

Wildcard permissions
Excessive privileges
Duplicate Roles

Task 06 — Review ClusterRoles

List ClusterRoles.

kubectl get clusterroles

Review:

kubectl describe clusterrole <role-name>

Identify:

cluster-admin
admin
edit
view
Custom ClusterRoles

Assess:

Business justification
Least privilege
Administrative scope

Task 07 — Audit RoleBindings

Review:

kubectl get rolebindings -A

Inspect bindings.

Confirm:

Correct namespace
Correct Service Account
Correct Role

Look for:

Obsolete bindings
Duplicate bindings
Incorrect namespace assignments

Task 08 — Audit ClusterRoleBindings

Review:

kubectl get clusterrolebindings

Inspect each binding.

Questions:

Who has cluster-admin?
Why do they need it?
Is approval documented?

Task 09 — Validate Least Privilege

Test permissions.

Examples:

kubectl auth can-i get pods

kubectl auth can-i create deployments

kubectl auth can-i delete namespaces

kubectl auth can-i get secrets

Document:

Allowed

Denied

Unexpected permissions

Task 10 — Review Workload Identity

Inspect Pods.

kubectl get pods -A

Review:

kubectl describe pod <pod-name>

Confirm:

Dedicated Service Account
Default Service Account
Token mounted
automountServiceAccountToken configuration

Task 11 — Audit OIDC & IRSA (Amazon EKS)

If using Amazon EKS:

Review:

aws eks describe-cluster \
--name <cluster-name>

Verify:

OIDC Provider
IAM Roles
IAM Policies
Trust Relationships

Confirm:

One IAM Role per workload
Least privilege
No shared IAM roles

Task 12 — Review Authentication Governance

Evaluate:

Naming standards
Namespace ownership
Service Account lifecycle
Identity documentation
Credential rotation
Approval process

Task 13 — Identify High-Risk Findings

Look for:

Shared Service Accounts
Default Service Accounts in production
Wildcard (*) permissions
cluster-admin misuse
Long-lived credentials
Orphaned Roles
Unused Service Accounts
Excessive ClusterRoleBindings

Assign severity:

Critical
High
Medium
Low

Task 14 — Identity Compliance Assessment

Evaluate compliance against:

CIS Kubernetes Benchmark
Kubernetes Security Best Practices
NIST Cybersecurity Framework
ISO/IEC 27001
Principle of Least Privilege

Task 15 — Create an Identity Risk Register

Finding	Risk	Severity	Recommendation

Examples:

Shared Service Accounts
Default identities
Excessive RBAC
Missing IRSA
Missing OIDC
Excessive ClusterRoles

Task 16 — Enterprise Identity Maturity Assessment

Evaluate each domain.

Domain	Rating (1–5)
Authentication
RBAC
Least Privilege
Service Accounts
IRSA / Workload Identity
Governance
Documentation
Compliance

Task 17 — Produce an Enterprise Audit Report

Document:

Environment:

Cluster:

Assessment Date:

Auditor:

Authentication Review

Service Account Review

RBAC Review

Role Review

ClusterRole Review

RoleBinding Review

OIDC Review

IRSA Review

Least Privilege Assessment

Compliance Status

Critical Findings

High Findings

Medium Findings

Low Findings

Recommendations

Overall Identity Security Rating

Task 18 — Present Remediation Plan

Prioritise improvements.

Priority 1

Remove unnecessary cluster-admin
Replace default Service Accounts
Remove wildcard permissions

Priority 2

Implement IRSA
Review trust relationships
Rotate credentials

Priority 3

Standardise naming
Improve documentation
Quarterly identity audits

Task 19 — Evidence Collection

Capture evidence for:

Service Accounts
Roles
ClusterRoles
RoleBindings
ClusterRoleBindings
Permission testing
IRSA configuration
OIDC provider
Identity maturity assessment
Final audit report

Task 20 — Clean Up

Remove any temporary audit resources created during the assessment.

Verify:

No unnecessary Service Accounts
No test Roles
No temporary RoleBindings

Skills Developed

By completing this lab, you will be able to:

Perform Kubernetes identity audits
Review enterprise RBAC
Assess workload authentication
Evaluate Service Accounts
Audit IAM integrations
Review OIDC configuration
Assess least privilege
Identify privilege escalation risks
Produce compliance evidence
Conduct enterprise security reviews

Knowledge Check

Question 1

Which Kubernetes object provides an identity for workloads?

A. ConfigMap
B. Service Account
C. Deployment
D. Secret

Answer: B

Question 2

Which RBAC object grants permissions across the entire cluster?

A. Role
B. Service
C. ClusterRole
D. ReplicaSet

Answer: C

Question 3

Why should wildcard (*) permissions generally be avoided?

A. They reduce cluster performance.
B. They violate the principle of least privilege by granting broad access.
C. They prevent Pods from starting.
D. They disable Kubernetes authentication.

Answer: B

Question 4

What is the primary benefit of IAM Roles for Service Accounts (IRSA) on Amazon EKS?

A. It increases Pod scheduling speed.
B. It replaces RBAC completely.
C. It provides temporary AWS credentials without storing long-lived access keys.
D. It automatically encrypts Kubernetes Secrets.

Answer: C

Question 5

Which finding should normally be considered the highest priority during an identity audit?

A. Missing labels on Namespaces
B. An unused ConfigMap
C. Broad use of the cluster-admin role without business justification
D. An old ReplicaSet

Answer: C

Lab Summary

In this lab, you performed a comprehensive enterprise identity audit of a Kubernetes environment by reviewing Service Accounts, RBAC objects, authentication mechanisms, workload identities, and cloud identity integrations. You assessed compliance with the principle of least privilege, identified excessive permissions and governance gaps, and prioritised remediation activities based on business risk.

These auditing techniques mirror the identity governance and access reviews carried out by Kubernetes Platform Engineering, Cloud Security, and Governance, Risk & Compliance (GRC) teams before production deployments, security assessments, and regulatory audits.

What’s Next?

➡️ Runbook 01 — Kubernetes Identity & Access Health Assessment

In the next exercise, you will move from implementation to day-to-day operations by performing routine health checks on Kubernetes authentication, Service Accounts, RBAC, workload identities, and access controls to ensure the platform remains secure and compliant over time.