Challenge
DifficultyEasy
Community stats58 solved of 75 attempts

Extracting and Decoding ServiceAccount Token from Kubernetes Secret

Omkar Shelke
by  Omkar Shelke · on
Kubernetes
Find the Secret that holds a ServiceAccount's token, decode the token, and read the identity it carries.
#serviceaccount#secret#jwt#cka#ckad

Scenario

The mars-sa-v2 ServiceAccount in the mars namespace has a long-lived token stored in a Secret.

Task

  1. Find the Secret that holds the token of the mars-sa-v2 ServiceAccount in the mars namespace. Write the name of that Secret to /home/laborant/secret-name.
  2. Save the token from that Secret to /home/laborant/token. The file must hold the token itself, not its Base64-encoded form.
  3. Read the payload of the token saved in /home/laborant/token. Write the value of its sub (subject) claim to /home/laborant/token-subject.
Hint 1 | How a token Secret is linked to a ServiceAccount

The name of a Secret proves nothing. A ServiceAccount token Secret has a specific type, and an annotation that names the ServiceAccount it belongs to:

kubectl get secrets -n <namespace>
kubectl describe secret <name> -n <namespace>

See: Manually create a long-lived API token for a ServiceAccount

Hint 2 | Getting one value out of a Secret

Every value under a Secret's data is Base64-encoded. A single field can be printed on its own and decoded:

kubectl get secret <name> -n <namespace> -o jsonpath='{.data.<key>}'
base64 --help
Hint 3 | Reading a JWT

A ServiceAccount token is a JSON Web Token: three parts separated by dots, header.payload.signature. The header and payload are Base64-encoded JSON, without the = padding at the end.

⚒ Test Cases

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge extracting-and-decoding-serviceaccount-token-from-kubernetes-secret-8cbb032a

This will create a local copy of the challenge content in a directory named extracting-and-decoding-serviceaccount-token-from-kubernetes-secret-8cbb032a. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge extracting-and-decoding-serviceaccount-token-from-kubernetes-secret-8cbb032a

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge