Skip to content

Room 32

ANNOTATIONS

The Metadata Archive

  • Annotations store non-identifying metadata - build info, URLs, tool config.
  • Find the hidden annotation across several deployments.

📜 Mission Briefing

  1. Apply annotated-deploy.yaml - several deployments with annotations.
  2. Find the deployment annotated with escape-room/password.
  3. Read its value to get the password: annotate.
Key Commands
Command Purpose
kubectl annotate pod NAME key=value Add annotation
kubectl describe deploy NAME See annotations
kubectl get deploy -o jsonpath='{.metadata.annotations}' Extract annotations
Annotations vs Labels
# Labels: Identify and select objects (used by selectors)
# Annotations: Store arbitrary metadata (not used for selection)

# Common annotations:
# kubernetes.io/change-cause: "Updated to v2"
# prometheus.io/scrape: "true"
# prometheus.io/port: "9090"
# nginx.ingress.kubernetes.io/rewrite-target: "/"

kubectl annotate deployment my-app \
  description="Main application" \
  escape-room/password=annotate

kubectl get deployment my-app \
  -o jsonpath='{.metadata.annotations.escape-room/password}'

# Remove annotation
kubectl annotate deployment my-app description-
Hints

Hint 1

kubectl get deploy --show-labels
kubectl describe deploy -l app=annotated-app

Hint 2

kubectl get deploy annotated-app -o jsonpath='{.metadata.annotations.escape-room/password}'

Hint 3

The password is annotate.

🔓 Unlock Room 33

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_33/README -out ../room_33/README.txt -pass pass:PASSWORD
cat ../room_33/README.txt