Lab — K8s
Kubernetes lab on kind YOUR cluster — RBAC matrix, NetworkPolicy stub, secrets audit bundled.
Visual · t31_k8s_lab
Lab: K8s hygiene pack on kind YOUR cluster. Original Cyberlium.
Ship K8s hygiene artifacts from YOUR kind cluster — RBAC, network policy, secrets — zero stranger kube API or pod pivot tests.
On YOUR `$CLOUD_LAB` kind YOUR cluster per brief: (1) scope proof — cluster context labeled YOUR machine; (2) RBAC matrix Module 7-1; (3) NetworkPolicy manifest stub Module 7-2; (4) secrets hygiene audit Module 7-3; (5) namespace diagram stub; (6) integrity — kind YOUR cluster only, no stranger kube API, no prod apply without RoE, no pod pivot attack repro; (7) chmod 600 pack. Cross-link Docker lab Module 6 — container image feeds K8s deploy row.
1. Lab deliverables
RBAC + NetworkPolicy + secrets audit — single lab namespace cross-index.
Namespace diagram shows frontend/backend pair and policy allow paths.
Command guide
Try these commands — Lab deliverables
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Optional command
kubectl auth can-i — https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access
kind — https://kind.sigs.k8s.io/docs/user/quick-start/ K8s security — https://kubernetes.io/docs/concepts/security/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Install kubectl from kubernetes.io docs
macOS:
Command — copy this
brew install kubectl
Windows: Install kubectl (Chocolatey or official)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}YOUR local cluster — optional kind/kubectl
Command — copy this
kubectl cluster-info 2>/dev/null || echo 'No cluster — apply yaml stubs when kind/minikube ready' kubectl auth can-i --list 2>/dev/null | head -10 || echo 'kubectl auth can-i on YOUR cluster only' kubectl apply --dry-run=client -f "$CLOUD_LAB/k8s/rbac-stub.yaml" 2>/dev/null || echo 'Validate rbac-stub.yaml syntax offline' kubectl apply --dry-run=client -f "$CLOUD_LAB/k8s/networkpolicy-stub.yaml" 2>/dev/null || echo 'Validate networkpolicy-stub.yaml offline' grep -E 'rbac-stub|networkpolicy-stub|YOUR cluster' "$CLOUD_LAB/k8s/secrets-hygiene-checklist.md" || ls "$CLOUD_LAB/k8s/"
═══ WINDOWS ═══
Command — copy this
kubectl cluster-info 2>$null; if (-not $?) { Write-Output 'Optional: kind/Docker Desktop K8s for YOUR cluster' }
Get-Content $HOME/cyberlium-lab/t31-cloud/k8s/rbac-stub.yaml | Select-String RolePrimary tools to practice this lesson: kubectl, grep. Reference sites: kubectl auth can-i (https://kubernetes.io/docs/reference/access-authn-authz/authorization/#checking-api-access); kind (https://kind.sigs.k8s.io/docs/user/quick-start/); K8s security (https://kubernetes.io/docs/concepts/security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Quality bar
Least-privilege RBAC — no cluster-admin on lab default.
Zero prod credentials or stranger cluster references in manifests.
3. Teardown
kind delete cluster or namespace per brief; secure notes chmod 600.
No lab manifests applied to prod without RoE.
4. What you ship: K8s lab pack
RBAC + NetworkPolicy + secrets audit + diagram + integrity — chmod 600.
5. What you record before the next lesson
K8s lab pack path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: K8s lab includes pod pivot script against stranger namespace as validation.
- Right: K8s lab pack on kind YOUR cluster. Next: quiz.
Mission: K8s lab
1) Scope and kind cluster proof. 2) RBAC matrix and NetworkPolicy stub. 3) Secrets audit three rows. 4) Integrity block; chmod 600.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “kind teardown — minimum cleanup?”
APPLY: K8s lab scope:
APPLY: True or False: Pod pivot between stranger namespaces is lab.
APPLY: K8s lab pack includes: