Security Flashcards

Which flag on the API server enables RBAC authorization mode?

Answer: --authorization-mode=RBAC

Setting `--authorization-mode=RBAC` (often alongside Node and Webhook) activates role-based access control on the API server.

An AppArmor profile is applied to a container using which mechanism in Kubernetes?

Answer: An annotation on the pod: `container.apparmor.security.beta.kubernetes.io/`

AppArmor profiles are applied via pod annotations in the format `container.apparmor.security.beta.kubernetes.io/: `.

What is the correct way to rotate a compromised cluster CA certificate without downtime?

Answer: Use kubeadm certs renew all and restart control plane components

`kubeadm certs renew all` regenerates all control-plane certificates and the kubelet client certificate using the existing CA.

Which Kubernetes audit policy level records both the request body and the full response body?

Answer: RequestResponse

`RequestResponse` is the most verbose audit level, capturing request and response bodies — useful for sensitive resource changes.

A pod needs to read a Secret value without mounting it as a file. Which approach injects it as an environment variable?

Answer: secretKeyRef in the env block

Using `secretKeyRef` in a container's `env` block injects a specific Secret key as an environment variable.

What does setting `runAsGroup: 3000` in a pod's SecurityContext enforce?

Answer: All container processes run with GID 3000

`runAsGroup` sets the primary GID for all container processes, controlling file permission checks and group-owned resource access.

Which kubeadm command can be used to view the expiration dates of all control plane certificates?

Answer: kubeadm certs check-expiration

`kubeadm certs check-expiration` displays all control plane certificate expiry dates in a formatted table.