Kubernetes Goat

✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀

🙌 Refer to https://madhuakula.com/kubernetes-goat for the guide 📖

🧰 Setting up Kubernetes Goat

• Ensure you have admin access to the Kubernetes cluster and installed kubectl. Refer to the docs for installation

• Ensure you have the helm package manager installed. Refer to the docs for installation

• To set up the Kubernetes Goat resources in your cluster, run the following commands:

git clone https://github.com/madhuakula/kubernetes-goat.git
cd kubernetes-goat
chmod +x setup-kubernetes-goat.sh
bash setup-kubernetes-goat.sh

• Ensure the pods are running before running the access script

kubectl get pods

• Access Kubernetes Goat by exposing the resources to the local system (port-forward) by the following command:

bash access-kubernetes-goat.sh

• Then navigate to http://127.0.0.1:1234

Refer to https://madhuakula.com/kubernetes-goat/docs/how-to-run for setting up Kubernetes Goat in various environments like GKE, EKS, AKS, K3S, KIND, etc.

🏆 Scenarios

1. Sensitive keys in codebases
2. DIND (docker-in-docker) exploitation
3. SSRF in the Kubernetes (K8S) world
4. Container escape to the host system
5. Docker CIS benchmarks analysis
6. Kubernetes CIS benchmarks analysis
7. Attacking private registry
8. NodePort exposed services
9. Helm v2 tiller to PwN the cluster - [Deprecated]
10. Analyzing crypto miner container
11. Kubernetes namespaces bypass
12. Gaining environment information
13. DoS the Memory/CPU resources
14. Hacker container preview
15. Hidden in layers
16. RBAC least privileges misconfiguration
17. KubeAudit - Audit Kubernetes clusters
18. Falco - Runtime security monitoring & detection
19. Popeye - A Kubernetes cluster sanitizer
20. Secure network boundaries using NSP
21. Cilium Tetragon - eBPF-based Security Observability and Runtime Enforcement
22. Securing Kubernetes Clusters using Kyverno Policy Engine

📖 Documentation Guide

Here is the detailed step by step guide for learning and using Kubernetes Goat 🎉: documentation guide

Reference: https://madhuakula.com/kubernetes-goat

⚠️ Disclaimer

Kubernetes Goat has intentionally created vulnerabilities, applications, and configurations to attack and gain access to your cluster and workloads. Please DO NOT run this alongside your production environments and infrastructure. We highly recommend running this in a safe and isolated (contained) environment.

Kubernetes Goat is used for educational purposes only. Do not test or apply these attacks on any systems without permission. Kubernetes Goat comes with absolutely no warranties, by using it you take full responsibility for all outcomes.

📝 License

MIT

✨ Acknowledgements

Thanks to to these wonderful people: 🎉

madhuakula	phpsystems	adamhurm	malwareowl	za	0xCardinal
dependabot[bot]	davi-cruz	mkcn	rewanthtammana	samriggs	nayanballa08
gvoden	avicoder	macagr	commjoen	ravenium	BlaiseOfGlory
llaltxll	hexachordanu	bzd111	William-LP	wurstbrot	... Content truncated. Click "See More" to view the full README. Kubernetes Goat ✨ The Kubernetes Goat is designed to be an intentionally vulnerable cluster environment to learn and practice Kubernetes security 🚀 🙌 Refer to https://madhuakula.com/kubernetes-goat for the guide 📖 🧰 Setting up Kubernetes Goat Ensure you have admin access to the Kubernetes cluster and installed kubectl. Refer to the docs for installation Ensure you have the helm package manager installed. Refer to the docs for installation To set up the Kubernetes Goat resources in your cluster, run the following commands: git clone https://github.com/madhuakula/kubernetes-goat.git cd kubernetes-goat chmod +x setup-kubernetes-goat.sh bash setup-kubernetes-goat.sh Ensure the pods are running before running the access script kubectl get pods Access Kubernetes Goat by exposing the resources to the local system (port-forward) by the following command: bash access-kubernetes-goat.sh Then navigate to http://127.0.0.1:1234 Refer to https://madhuakula.com/kubernetes-goat/docs/how-to-run for setting up Kubernetes Goat in various environments like GKE, EKS, AKS, K3S, KIND, etc. 🏆 Scenarios Sensitive keys in codebases DIND (docker-in-docker) exploitation SSRF in the Kubernetes (K8S) world Container escape to the host system Docker CIS benchmarks analysis Kubernetes CIS benchmarks analysis Attacking private registry NodePort exposed services Helm v2 tiller to PwN the cluster - [Deprecated] Analyzing crypto miner container Kubernetes namespaces bypass Gaining environment information DoS the Memory/CPU resources Hacker container preview Hidden in layers RBAC least privileges misconfiguration KubeAudit - Audit Kubernetes clusters Falco - Runtime security monitoring & detection Popeye - A Kubernetes cluster sanitizer Secure network boundaries using NSP Cilium Tetragon - eBPF-based Security Observability and Runtime Enforcement Securing Kubernetes Clusters using Kyverno Policy Engine 📖 Documentation Guide Here is the detailed step by step guide for learning and using Kubernetes Goat 🎉: documentation guide Reference: https://madhuakula.com/kubernetes-goat ⚠️ Disclaimer Kubernetes Goat has intentionally created vulnerabilities, applications, and configurations to attack and gain access to your cluster and workloads. Please DO NOT run this alongside your production environments and infrastructure. We highly recommend running this in a safe and isolated (contained) environment. Kubernetes Goat is used for educational purposes only. Do not test or apply these attacks on any systems without permission. Kubernetes Goat comes with absolutely no warranties, by using it you take full responsibility for all outcomes. 📝 License MIT ✨ Acknowledgements Thanks to to these wonderful people: 🎉 madhuakula phpsystems adamhurm malwareowl za 0xCardinal dependabot[bot] davi-cruz mkcn rewanthtammana samriggs nayanballa08 gvoden avicoder macagr commjoen ravenium BlaiseOfGlory llaltxll hexachordanu bzd111 William-LP wurstbrot suneshgovind SumoSumir smoyer64 pichuang nmiekley NF997 Like0x Allevon412 aaaart3m AmeerAssadi apvarun ant4g0nist See More See Less Tool Information Tool Details kubernetes-goat Vulnerable-labs Kubernetes Goat is a "Vulnerable by Design" cluster environment to learn and practice Kubernetes security using an interactive hands-on playground 🚀 Author madhuakula License MIT License Homepage https://madhuakula.com/kubernetes-goat First Commit June 04, 2020 GitHub Statistics Stars 4777 Forks 798 Issues 30 Contributors 30 +22 View on GitHub Tool Information Author madhuakula Project Added On May 29, 2025 License Open Source Tags blueteam cloud-native cloud-security cloudsecurity container container-security devsecops docker hacking infrastructure k8s kubernetes kubernetes-goat kubernetes-security owasp pentesting redteam security vulnerable-app View on GitHub Related Tools IWA-Java Insecure Web + API application with example Fortify integrations into many DevSecOps and CICD platforms Stable IWA-DotNet Insecure Web Application - .NET version Stable damn-vulnerable-MCP-server Damn Vulnerable MCP Server Stable View more Vulnerable-labs tools