Credential Overview Flashcards

What does the signerName field in a CertificateSigningRequest specify?

Answer: The CA authority that will sign the certificate

The signerName field identifies which signer (e.g., kubernetes.io/kube-apiserver-client) will issue the certificate after approval.

Which built-in signer name should be used when creating a CSR for a new kubectl user with client authentication?

Answer: kubernetes.io/kube-apiserver-client

The kubernetes.io/kube-apiserver-client signer is used for certificates that authenticate to the kube-apiserver as a user.

How can an administrator revoke a compromised user's X.509 client certificate in Kubernetes?

Answer: Rotate the cluster CA to invalidate all existing certificates

Kubernetes does not support CRL or OCSP; revoking a single certificate requires rotating the cluster CA, which invalidates all certificates signed by it.

In a kubeconfig file, where is the cluster CA certificate typically stored?

Answer: Under clusters[].cluster.certificate-authority-data

The base64-encoded cluster CA certificate is stored in clusters[].cluster.certificate-authority-data to verify the API server's TLS certificate.

Which Kubernetes authentication strategy uses the --token-auth-file flag on the API server?

Answer: Static token file

The --token-auth-file flag enables static token file authentication, which reads bearer tokens from a CSV file on the API server's filesystem.

What is the role of the 'groups' claim in an OIDC token when used with Kubernetes?

Answer: It provides the list of RBAC group memberships for the user

The groups claim in an OIDC id_token maps to Kubernetes RBAC groups, enabling group-based access control via ClusterRoleBindings or RoleBindings.

Which kubectl command displays the current active kubeconfig context?

Answer: kubectl config current-context

kubectl config current-context prints the name of the currently active context from the kubeconfig file.