# Kubernetes Nightmare — Cluster Audit (CTF challenge)

> ANALYSIS CHALLENGE (no live cluster — real RBAC/etcd abuse can't run in the sandbox). Review the Kubernetes manifests: an over-permissive ClusterRoleBinding lets a namespace workload read Secrets…

Canonical: https://codelivly.com/ctf/challenges/kubernetes-nightmare-audit

| | |
|---|---|
| Category | Cloud Security |
| Difficulty | Hard |
| Points | 3500 |
| Estimated time | 40 min |
| Type | Live instance |
| Solves | 21 |
| Author | Codelivly |

ANALYSIS CHALLENGE (no live cluster — real RBAC/etcd abuse can't run in the sandbox). Review the Kubernetes manifests: an over-permissive ClusterRoleBinding lets a namespace workload read Secrets cluster-wide, and its pod auto-mounts the API token. Recover the cluster bootstrap token the attacker would read. Your own isolated instance; the token is unique to you.

## Related

- [All CTF challenges](https://codelivly.com/practice?type=ctf)