Challenge
DifficultyMedium
Community stats40 solved of 52 attempts

Inspecting and Extracting Kubernetes Kubeconfig Data

Omkar Shelke
by  Omkar Shelke · on
Kubernetes
Audit a kubeconfig handed over by another engineer: list its contexts, find the active context and the cluster it points to, and extract the client certificate it authenticates with.
#kubernetes-101#kubeconfig#client-cert#k8s-context#cka

Scenario

An engineer moving to another team handed over their kubeconfig. It is at /home/laborant/admin-kubeconfig on dev-machine.

Before anyone uses it, the security team wants a record of what it gives access to: which contexts it defines, which one is active, which cluster that context reaches, and which identity it authenticates as.

The kubeconfig holds several clusters, users, and contexts. Some users authenticate with a client certificate and some with a token.

Note

Work on dev-machine as the default laborant user. Root access is not needed. Do not change the kubeconfig.

Task

Every answer comes from /home/laborant/admin-kubeconfig, not from the default kubeconfig.

  1. Write the names of all contexts in /home/laborant/admin-kubeconfig to /home/laborant/context-list, one name per line.
  2. Write the name of the active context in /home/laborant/admin-kubeconfig to /home/laborant/active-context.
  3. Write the name of the cluster associated with that active context to /home/laborant/active-cluster.
  4. Write the client certificate of the user that active context authenticates as to /home/laborant/client-cert, decoded to PEM format.
Hint 1 | How a kubeconfig is organised

A kubeconfig has three lists and one pointer:

FieldWhat it holds
clustersAPI server addresses and their CA certificates
usersCredentials, such as a client certificate or a token
contextsNamed pairs of one cluster and one user, plus an optional namespace
current-contextThe name of the context kubectl uses by default

kubectl config reads any kubeconfig file you point it at:

kubectl config --help
kubectl config <subcommand> --kubeconfig=<path>
Hint 2 | Looking only at the active context

The users list is not in the same order as the contexts list, so the position of an entry tells you nothing. kubectl config view has a flag that limits its output to the cluster, user, and context the active context uses:

kubectl config view --help
Hint 3 | Getting at the certificate data

kubectl config view hides certificate and key data unless asked to show it. The data it holds is base64-encoded, and a single field can be printed on its own:

kubectl config view --kubeconfig=<path> <flags> -o jsonpath='{<path-to-field>}'
base64 --help

⚒ Test Cases

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge inspecting-and-extracting-kubernetes-kubeconfig-data-50e5b3b3

This will create a local copy of the challenge content in a directory named inspecting-and-extracting-kubernetes-kubeconfig-data-50e5b3b3. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge inspecting-and-extracting-kubernetes-kubeconfig-data-50e5b3b3

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start challenge