madhuakula/kubernetes-goat

Kubernetes Goat is a deliberately insecure training environment for learning about Kubernetes security. Kubernetes is a system used by companies to run and manage software in containers at scale, and securing it correctly is a common challenge. Kubernetes Goat sets up a cluster that is full of intentional security mistakes so that students and practitioners can practice finding and exploiting them in a controlled setting, without touching real production infrastructure. The project ships 22 hands-on scenarios covering real-world problems, including sensitive credentials left in code, containers escaping to the underlying host, misconfigured role-based access controls, exposed network services, namespace bypasses, and crypto miner detection. Later scenarios also introduce defensive tools, such as using Falco for runtime monitoring, Kyverno for policy enforcement, and Cilium Tetragon for tracking what processes do inside containers. Setting it up requires admin access to a Kubernetes cluster and a package manager called Helm. A setup script deploys all the vulnerable workloads, and an access script forwards the relevant ports to your local machine so you can reach the training interface at a local address in your browser. The documentation site walks through each scenario step by step. The project also supports running in managed cloud Kubernetes environments like GKE, EKS, and AKS. The project warns clearly that Kubernetes Goat should never run alongside production systems, since its vulnerabilities are real and exploitable. It is intended for education in isolated environments only. The project is released under the MIT license.