What problem does it solve? In Kubernetes-based CTF challenges, the decisive path often runs through control-plane state rather than a single container, and it is hard to connect API permissions, admission mutations, and controller behavior to the actual workload or secret effect. This Skill provides a structured methodology for tracing principals, RBAC edges, and object mutations down to the smallest cluster action that produces the decisive result. ## Core Features & Use Cases - API Trust Path Mapping: Records namespaces, service accounts, Roles, ClusterRoles, bindings, admission hooks, and controllers, distinguishing read, create, patch, exec, and secret access. - Mutation-to-Workload Tracing: Shows how an API action becomes a pod, volume mount, secret exposure, env injection, or controller-created artifact, comparing checked-in YAML against live objects after admission and reconciliation. - Decisive Path Reduction: Compresses findings into the smallest chain of principal, API permission, mutated object, and resulting workload or secret effect, with evidence blocks kept per namespace and controller. - Use Case: During a CTF, you find a service-account token in a pod. Use this Skill to enumerate its RoleBindings, prove which API actions it allows, and demonstrate the exact object creation that exposes the flag-bearing secret. ## Quick Start Ask the assistant to map this service account's RBAC permissions and trace which cluster objects it can mutate to reach the target secret.
