Security Flashcards

What is the purpose of the `seccomp` profile `RuntimeDefault` in a pod's SecurityContext?

Answer: Applies the container runtime's default syscall allowlist

`RuntimeDefault` applies the container runtime's (e.g., containerd) built-in seccomp profile that blocks dangerous syscalls.

Which RBAC verb is needed to allow a user to exec into a running pod?

Answer: exec

The `exec` verb on the `pods/exec` subresource is required to run `kubectl exec` against a pod.

You want to audit all requests that resulted in a 403 response. Which audit policy level captures the request metadata including response code?

Answer: Metadata

The `Metadata` audit level records request metadata including verb, user, resource, and response code without capturing the body.

A ClusterRole with `resourceNames: ["my-secret"]` restricts access to what?

Answer: Only the specific secret named my-secret

`resourceNames` limits the role to operate only on the named resource instance, not all instances of that resource type.

Which tool is built into Kubernetes to encrypt etcd data at rest for Secrets?

Answer: EncryptionConfiguration with a provider like AES-CBC

An EncryptionConfiguration file referenced by the API server's `--encryption-provider-config` flag encrypts etcd data at rest.

What does `automountServiceAccountToken: false` on a pod spec do?

Answer: Prevents the ServiceAccount token from being mounted into the pod

Setting `automountServiceAccountToken: false` stops Kubernetes from projecting the token into `/run/secrets/kubernetes.io/serviceaccount/`, reducing attack surface.

Which Kubernetes admission controller validates and mutates resources based on custom policies using webhooks?

Answer: ValidatingAdmissionWebhook

`ValidatingAdmissionWebhook` calls external webhook servers to accept or reject API requests based on custom policy logic.