Lab 01 — Kubernetes Cluster Enumeration

Mission Information

Property	Value
Lab Name	Kubernetes Cluster Enumeration
Module	Module 05 — Kubernetes Offensive Security
Difficulty	Intermediate
Estimated Time	90–120 Minutes
Lab Type	Guided Hands-on Lab
Platform	Kubernetes (Minikube / Kind / Amazon EKS / Azure AKS / Google GKE)
Prerequisites	Module 05 Lessons 01–03
Skills Covered	Cluster Enumeration, Reconnaissance, Kubernetes Architecture, Resource Discovery, Security Assessment

Mission Brief

CloudNova Technologies has been engaged by an enterprise customer to perform an authorized security assessment of their Kubernetes environment.

Before attempting any security validation, your consulting team must build a complete understanding of the Kubernetes cluster. The customer has limited documentation, so your first task is to enumerate the environment, identify critical assets, and document the attack surface.

Rather than exploiting vulnerabilities, this engagement focuses on collecting information that will support later assessment phases.

Your objective is to create a professional inventory of the Kubernetes environment following enterprise consulting practices.

Learning Objectives

By completing this lab, you will learn how to:

Connect to a Kubernetes cluster.
Enumerate cluster resources.
Identify worker nodes.
Review namespaces.
Discover workloads.
Enumerate Services.
Review RBAC resources.
Identify Service Accounts.
Review Secrets.
Assess networking configuration.
Build a Kubernetes asset inventory.

Enterprise Scenario

The customer operates multiple business-critical applications inside Kubernetes.

Management has requested:

An inventory of cluster resources.
A review of deployed workloads.
Identification of privileged resources.
Documentation of networking components.
A security-focused asset inventory.

This information will form the foundation of the remaining penetration testing engagement.

Lab Architecture

Enterprise Kubernetes Cluster

        │

 Kubernetes API Server

        │

 ├── Worker Node 01
 ├── Worker Node 02
 ├── Worker Node 03

        │

Namespaces

├── kube-system
├── default
├── production
├── development
├── monitoring

        │

Pods

↓

Services

↓

Deployments

↓

RBAC

↓

Secrets

↓

Networking

Mission Tasks

Task 01 — Connect to the Kubernetes Cluster

Objective

Verify access to the cluster.

Review

Cluster name
Kubernetes version
API server
Current context

Evidence

Capture:

Cluster information
Kubernetes version
Current context

Task 02 — Enumerate Nodes

Review:

Worker nodes
Node status
Labels
Internal IP addresses
Kubernetes version

Document:

Node inventory
Operating system
Cluster roles

Task 03 — Enumerate Namespaces

Review every namespace.

Document:

Namespace name
Business purpose
Critical workloads
Administrative namespaces

Pay particular attention to:

kube-system
production
development
monitoring

Task 04 — Enumerate Workloads

Identify:

Pods
Deployments
ReplicaSets
StatefulSets
DaemonSets
Jobs
CronJobs

Document:

Namespace
Application
Status
Container image
Owner

Task 05 — Enumerate Services

Review:

ClusterIP
NodePort
LoadBalancer
ExternalName

Identify:

Internal services
Public services
Administrative interfaces

Document exposed services.

Task 06 — Enumerate RBAC

Review:

Roles
ClusterRoles
RoleBindings
ClusterRoleBindings

Identify:

Cluster administrators
High-privilege roles
Service Account assignments

Task 07 — Enumerate Service Accounts

Review:

Service Account names
Namespace
Assigned permissions
Associated workloads

Document identities requiring further assessment.

Task 08 — Review Kubernetes Secrets

Inventory:

Secret names
Secret types
Namespace
Application ownership

Do not expose secret values.

Focus on identifying:

Database credentials
TLS certificates
Service Account tokens
Registry credentials

Task 09 — Review Networking

Assess:

Services
Ingress resources
Network Policies
DNS configuration

Document:

Public endpoints
Internal communication paths
Namespace isolation

Task 10 — Build Enterprise Asset Inventory

Produce an inventory containing:

Nodes
Namespaces
Workloads
Services
Identities
Secrets
Network resources
Administrative components

Expected Deliverables

Prepare the following consulting deliverables.

Cluster Inventory

Include:

Kubernetes version
Cluster information
Node inventory
Namespace inventory

Workload Inventory

Document:

Pods
Deployments
StatefulSets
DaemonSets
Jobs

Identity Inventory

Include:

Service Accounts
Roles
ClusterRoles
RoleBindings
ClusterRoleBindings

Network Inventory

Include:

Services
Ingress
Network Policies
External endpoints

Initial Security Observations

Record any findings such as:

Excessive RBAC permissions
Public services
Missing Network Policies
Privileged workloads
Dormant namespaces
Unused Service Accounts

Success Criteria

You have successfully completed this lab when you can:

Build a complete Kubernetes inventory.
Identify critical workloads.
Document cluster architecture.
Discover identities and permissions.
Identify exposed services.
Produce a consulting-quality asset inventory.

Skills Gained

After completing this lab, you will be able to:

Perform Kubernetes reconnaissance.
Enumerate enterprise Kubernetes clusters.
Identify critical infrastructure.
Document Kubernetes resources.
Build professional consulting deliverables.
Prepare for deeper security assessments.

Challenge Exercises

If time permits:

Compare development and production namespaces.
Identify workloads exposed externally.
Review namespace isolation.
Determine which workloads use Service Accounts.
Identify high-value assets that should receive priority during the assessment.

Lab Summary

In this lab, you performed a structured Kubernetes cluster enumeration following the GoHackersCloud Enterprise Assessment Methodology.

You created a comprehensive inventory of the Kubernetes environment, documented critical assets, and identified areas requiring deeper security assessment. These activities mirror the initial discovery phase performed by Cloud Penetration Testers and Kubernetes Security Consultants during real-world enterprise engagements.

Next Lab

➡️ Lab 02 — RBAC Exploitation

In the next lab, you will review Kubernetes RBAC configurations, identify excessive permissions, assess identity governance, and evaluate authorization controls using the GoHackersCloud enterprise security assessment methodology.