CKA Security Practices 4

Question 1

Which component is responsible for issuing certificates to kubelets in a Kubernetes cluster?

Accepted Answer

kube-controller-manager

Answer

The kube-controller-manager runs the Certificate Signing Request (CSR) controller that approves and issues certificates to kubelets via the certificates.k8s.io API.

Question 2

An attacker compromises a node. Which admission controller limits what a kubelet can do to other nodes' resources?

Accepted Answer

NodeRestriction

Answer

The NodeRestriction admission controller prevents kubelets from modifying Node or Pod objects that are not bound to their own node.

Question 3

What is the recommended way to provide a pod with AWS/GCP cloud credentials in Kubernetes?

Accepted Answer

Use workload identity / IRSA via a ServiceAccount annotation

Answer

Workload identity (e.g., AWS IRSA or GCP Workload Identity) binds Kubernetes ServiceAccounts to cloud IAM roles, eliminating the need to manage static credentials.

Question 4

Which command checks if a service account named `deployer` in the `staging` namespace can create Deployments?

Accepted Answer

kubectl auth can-i create deployments --as=system:serviceaccount:staging:deployer -n staging

Answer

The `--as` flag in `kubectl auth can-i` allows impersonating a service account to check its specific permissions.

Question 5

What does encrypting etcd at rest protect against?

Accepted Answer

Unauthorized access to Secrets if the etcd disk is compromised

Answer

Encrypting etcd at rest ensures that Secrets and other sensitive data stored in etcd are unreadable if an attacker gains raw disk or backup access.

(CKA) Certified Kubernetes Associate Practice Test

(CKA) Certified Kubernetes Associate Practice Test

CKA Security Practices 4