KCNA Security and RBAC 3 — Questions and Answers
Question 1: What is the purpose of the `securityContext` field at the container level in a Pod spec?
- To configure RBAC rules for the container
- To set security settings like runAsUser and allowPrivilegeEscalation (Correct answer)
- To define network policies for the container
- To mount secret volumes into the container
Correct answer: To set security settings like runAsUser and allowPrivilegeEscalation
The container-level `securityContext` sets security parameters such as runAsUser, runAsNonRoot, readOnlyRootFilesystem, and allowPrivilegeEscalation.
Question 2: Which command would you use to check what permissions a specific ServiceAccount has in Kubernetes?
- kubectl describe serviceaccount
- kubectl auth can-i --as=system:serviceaccount:<ns>:<name> (Correct answer)
- kubectl get rolebindings --serviceaccount
- kubectl check permissions
Correct answer: kubectl auth can-i --as=system:serviceaccount:<ns>:<name>
The `kubectl auth can-i` command with the `--as` flag lets you impersonate a ServiceAccount to verify its permissions.
Question 3: What is a 'subject' in the context of Kubernetes RBAC?
- The resource type being accessed
- The namespace where the policy applies
- A user, group, or ServiceAccount that a RoleBinding targets (Correct answer)
- The API group of a resource
Correct answer: A user, group, or ServiceAccount that a RoleBinding targets
In RBAC, subjects are the entities (users, groups, or ServiceAccounts) that are granted permissions via RoleBindings or ClusterRoleBindings.
Question 4: Which Kubernetes feature allows you to restrict egress and ingress traffic to/from Pods?
- RBAC Policies
- NetworkPolicy (Correct answer)
- PodSecurityPolicy
- AdmissionController
Correct answer: NetworkPolicy
NetworkPolicy resources define rules that control the allowed ingress and egress traffic for Pods based on labels and namespaces.
Question 5: What does the `runAsNonRoot: true` setting in a Pod's securityContext enforce?
- Forces the container to run as user ID 0
- Prevents the container from running if its image would run as root (Correct answer)
- Drops all Linux capabilities from the container
- Mounts the root filesystem as read-only
Correct answer: Prevents the container from running if its image would run as root
Setting `runAsNonRoot: true` causes the kubelet to validate that the container does not run as UID 0 (root), rejecting it if it would.
Question 6: In Kubernetes, which group represents all authenticated users?
- system:masters
- system:authenticated (Correct answer)
- system:nodes
- system:serviceaccounts
Correct answer: system:authenticated
The `system:authenticated` group is a built-in group that includes all authenticated users regardless of their identity.
Question 7: What is the effect of binding a subject to the built-in 'cluster-admin' ClusterRole?
- Grants read-only access to all cluster resources
- Grants full superuser access to all resources in the cluster (Correct answer)
- Grants admin access only to the default namespace
- Grants the ability to manage RBAC resources only
Correct answer: Grants full superuser access to all resources in the cluster
The 'cluster-admin' ClusterRole grants full superuser access, allowing any action on any resource in any namespace or at the cluster scope.
KCNA Security and RBAC 3
What is the purpose of the `securityContext` field at the container level in a Pod spec?