hac01/owasp-top-10-k8s-2025

This project is a hands-on capture-the-flag training environment built around the OWASP Kubernetes Top 10 for 2025, a published list of the most common security weaknesses in Kubernetes clusters. Instead of teaching those risks through slides, it gives you a real, deliberately vulnerable Kubernetes cluster tied to a fictional e-commerce company called NimbusMart, and ten challenges plus one bonus challenge, one for each risk on the list. For each challenge, you get a short mission briefing describing the scenario, a flag you can only reach by actually performing the exploit, such as breaking out of a container or reaching another namespace over the network, and a scoreboard in the web app that tracks your progress. Once you capture a flag, the project also gives you a deep dive on why the weakness exists, a defense guide with concrete fixes, and an automated Go program that checks whether your fix actually closes the hole. Topics covered include privileged containers and node breakout, overly broad permissions in Kubernetes role-based access control, hardcoded secrets, missing network segmentation, exposed internal dashboards, weak authentication, poor logging, and a bonus challenge on using untrusted container images in production. Everything runs locally inside a kind cluster, which is a way of running Kubernetes inside Docker on your own machine, and the README is explicit that the vulnerable setups should never be pointed at a real cluster. A single setup script builds the cluster, a Next.js and React web app, and an in-browser terminal that has full administrative access to that local, disposable cluster only. Getting started requires Docker, kind, kubectl, and Go installed locally, with Node.js needed only if you want to run the web app outside the cluster. This project is aimed at people learning Kubernetes security through practice, such as security engineers, DevOps engineers, or students studying for cloud security roles.