Skip to content

Room 04

NAMESPACES

The Isolation Ward

  • The cluster is a sprawling city, and namespaces are its neighborhoods.
  • A rogue namespace has been created with critical data - find it and extract the password.

📜 Mission Briefing

  1. List all namespaces in the cluster: kubectl get namespaces.
  2. Create a new namespace called escape-ward.
  3. Deploy a pod named data-vault running busybox in the escape-ward namespace: 
    kubectl run data-vault --image=busybox --namespace=escape-ward \
  --command -- sleep 3600
  4. Set a label on the namespace: kubectl label namespace escape-ward password=nsdefault.
  5. Verify by reading the namespace labels.
  6. The password is the value of the password label: nsdefault.
Key Commands
Command Purpose
kubectl get namespaces List all namespaces
kubectl create namespace NAME Create a namespace
kubectl delete namespace NAME Delete a namespace
kubectl label namespace NAME key=value Add label to namespace
kubectl get namespace NAME --show-labels Show namespace labels
kubectl config set-context --current --namespace=NS Set default namespace
kubectl run POD --image=IMG -n NS Run pod in namespace
How Namespaces Work
# Namespaces provide virtual clusters within a physical cluster
# Default namespaces: default, kube-system, kube-public, kube-node-lease

# Create a namespace
kubectl create namespace dev
kubectl create namespace staging
kubectl create namespace production

# Create namespace from YAML
cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Namespace
metadata:
  name: my-app
  labels:
    environment: development
    team: backend
EOF

# Switch default namespace
kubectl config set-context --current --namespace=my-app

# List resources in a namespace
kubectl get all -n my-app

# Cross-namespace DNS: service.namespace.svc.cluster.local
# Example: mysql.database.svc.cluster.local
Hints

Hint 1

Create the namespace and deploy the pod: 

kubectl create namespace escape-ward
kubectl run data-vault --image=busybox -n escape-ward --command -- sleep 3600

Hint 2

Label the namespace: 

kubectl label namespace escape-ward password=nsdefault

Hint 3

The password is nsdefault.

🔓 Unlock Room 05

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_05/README             \
        -out ../room_05/README.txt        \
        -pass pass:PASSWORD
cat ../room_05/README.txt