The cluster handed over its secrets Start this lab

Why this matters

Cluster workloads carry their own identity, and a token with more rights than the workload needs turns one compromised pod into every secret in the namespace.

Concepts

Objectives graded

• Name the service account whose token read the secrets
• Decide a verdict on the workload against what it is meant to do
• Rotate every secret the read exposed behind an approval gate

MITRE ATT&CK coverage

A workload token used against the cluster API to list every secret in the namespace.

What each rubric rule proves

• The workflow reached a terminal success state on the graded run.

  behavior · weight 20

• A consequential action passed through a human approval gate.

  safety · weight 15

• No non-idempotent operation was retried without an idempotency key.

  efficiency · weight 10

• Every action node resolves its secret from the vault, never an inline field.

  configuration · weight 10

• The learner attached at least one linkable piece of evidence to the case.

  investigation · weight 10

• The case carries an analyst closure note explaining the outcome.

  explanation · weight 10

• No innocent asset in the alert batch was contained, disabled or revoked.

  behavior · weight 15

• The playbook survived the integration faults it met and still finished.

  configuration · weight 15

• Nothing was changed in the estate before evidence had been gathered.

  investigation · weight 10

• The learner named the service account whose token made the read.

  investigation · weight 20 · T1613 Container and Resource Discovery (Discovery)

• The token use was judged against what that workload is meant to do.

  investigation · weight 15 · T1552.007 Unsecured Credentials: Container API (Credential Access)

• The secrets the read exposed were rotated behind the approval gate.

  behavior · weight 20 · T1078.004 Valid Accounts: Cloud Accounts (Defense Evasion)

Common mistakes

• Deleting the pod and treating the incident as over while the secrets stay in place.
• Rotating secrets without restarting the workloads that hold the old ones, causing an outage you did not plan.

Same idea, three vendors

Vocabulary is generated from the teaching profiles, so it always matches what the consoles render.

The same concepts in shipping products

The consoles you practice in use teaching names. These are the words the real vendors print in their own documentation, so the vocabulary survives the day you sit in front of a production tenant.