Skip to content

Room 26

SERVICEACCOUNTS

The Identity Forge

  • Every pod runs under a ServiceAccount. ServiceAccounts provide identity for processes in Kubernetes.
  • Create a custom ServiceAccount and use it to authenticate to the API.

📜 Mission Briefing

  1. List ServiceAccounts: kubectl get sa.
  2. Every namespace has a default ServiceAccount.
  3. Create a new ServiceAccount escape-agent.
  4. Create a pod that uses escape-agent as its ServiceAccount.
  5. From inside the pod, call the K8s API using the SA token.
  6. The ServiceAccount has an annotation with the password: svcacct42.
Key Commands
Command Purpose
kubectl get sa List ServiceAccounts
kubectl create sa NAME Create ServiceAccount
kubectl describe sa NAME SA details
kubectl get sa NAME -o yaml SA YAML with secrets
How ServiceAccounts Work
apiVersion: v1
kind: ServiceAccount
metadata:
  name: escape-agent
  annotations:
    escape-password: "svcacct42"
automountServiceAccountToken: true
---
apiVersion: v1
kind: Pod
metadata:
  name: sa-pod
spec:
  serviceAccountName: escape-agent   # Use custom SA
  containers:
    - name: app
      image: curlimages/curl
      command: ['sh', '-c', 'sleep 3600']

# ServiceAccount token is auto-mounted at:
# /var/run/secrets/kubernetes.io/serviceaccount/token

# From inside a pod, call the K8s API:
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
CACERT=/var/run/secrets/kubernetes.io/serviceaccount/ca.crt
APISERVER=https://kubernetes.default.svc

curl --cacert $CACERT -H "Authorization: Bearer $TOKEN" \
  $APISERVER/api/v1/namespaces/default/pods

# Kubernetes 1.24+: SA tokens are bound (projected) and expire
# No longer creates long-lived Secret tokens automatically

# Disable token mounting for pods that don't need API access
apiVersion: v1
kind: Pod
spec:
  automountServiceAccountToken: false
Hints

Hint 1

kubectl create sa escape-agent
kubectl annotate sa escape-agent escape-password=svcacct42

Hint 2

kubectl get sa escape-agent -o jsonpath='{.metadata.annotations.escape-password}'

Hint 3

The password is svcacct42.

🔓 Unlock Room 27

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_27/README             \
        -out ../room_27/README.txt        \
        -pass pass:PASSWORD
cat ../room_27/README.txt