Security Flashcards

Which admission controller enforces Pod Security Standards when you label a namespace with `pod-security.kubernetes.io/enforce: restricted`?

Answer: PodSecurity

The PodSecurity admission controller (GA in 1.25) enforces Pod Security Standards using namespace labels.

A ServiceAccount token mounted in a pod by default has what scope of access in Kubernetes 1.24+?

Answer: No RBAC permissions unless explicitly granted

ServiceAccounts have no permissions by default; RBAC must explicitly grant them roles.

What flag on a container's SecurityContext prevents privilege escalation via setuid binaries?

Answer: allowPrivilegeEscalation: false

`allowPrivilegeEscalation: false` sets the no_new_privs flag, blocking setuid/setgid escalation.

Which kubeconfig field stores the cluster's certificate authority data used by kubectl to verify the API server?

Answer: certificate-authority-data

`certificate-authority-data` holds the base64-encoded CA bundle that kubectl uses to trust the API server's TLS certificate.

An attacker exploits a container and tries to read `/run/secrets/kubernetes.io/serviceaccount/token`. What is this file?

Answer: A projected ServiceAccount JWT used to authenticate to the API server

Kubernetes mounts a projected ServiceAccount JWT at that path, which pods use to authenticate API requests.

Which Kubernetes object can restrict egress traffic from pods in a namespace to only port 5432 on a specific database pod?

Answer: NetworkPolicy

NetworkPolicy objects control pod-level ingress and egress traffic using label selectors and port rules.

When using `kubectl certificate approve`, what signer must be used for a kubelet serving certificate CSR?

Answer: kubernetes.io/kubelet-serving

The `kubernetes.io/kubelet-serving` signer is used for kubelet serving certificates that authenticate the kubelet's HTTPS endpoint.