Security Flashcards

You need to grant a CI/CD pipeline read-only access to pods in only the `staging` namespace. Which combination is correct?

Answer: Role in staging + RoleBinding in staging

A Role scoped to `staging` combined with a RoleBinding in `staging` grants access limited to that namespace only.

What does the `NodeRestriction` admission controller prevent?

Answer: Kubelets from modifying labels or resources outside their own node/pods

NodeRestriction limits the kubelet's API server write access to its own Node object and pods scheduled on it, preventing lateral movement.

Which field in a CertificateSigningRequest (CSR) object specifies what the certificate will be used for?

Answer: spec.usages

`spec.usages` lists key usage extensions like `client auth` or `server auth` that restrict how the issued certificate can be used.

A Pod Security Standard level that blocks host namespaces, privileged containers, and requires non-root is called:

Answer: Restricted

The `Restricted` Pod Security Standard enforces the most stringent hardening requirements including non-root, no privilege escalation, and seccomp.

What happens to existing pods in a namespace when you change its Pod Security Standard enforcement label to `restricted`?

Answer: Existing pods are unaffected; only new or updated pods are evaluated

Admission control only applies to new admission requests; existing running pods are not re-evaluated when labels change.

Which command generates a private key and CSR for a new Kubernetes user named `alice`?

Answer: openssl req -newkey rsa:2048 -keyout alice.key -out alice.csr -subj '/CN=alice/O=dev'

openssl generates the RSA key and CSR with the CN (username) and O (group) fields used by Kubernetes for authentication.

Which security mechanism prevents a compromised pod from reading another pod's network traffic on the same node?

Answer: Pod-level network namespace isolation by the container runtime

Each pod gets its own Linux network namespace by default, so a compromised pod cannot sniff another pod's traffic without host network access.