KCNA Security and RBAC 4 — Questions and Answers
Question 1: Which Kubernetes component is responsible for authenticating requests to the API server?
- etcd
- kube-scheduler
- kube-apiserver (Correct answer)
- kube-controller-manager
Correct answer: kube-apiserver
The kube-apiserver handles authentication of all API requests using configured authenticator plugins (certificates, tokens, OIDC, etc.).
Question 2: What is the Kubernetes API group for RBAC resources like Role and RoleBinding?
- core
- rbac.authorization.k8s.io (Correct answer)
- authorization.kubernetes.io
- policy
Correct answer: rbac.authorization.k8s.io
RBAC resources (Role, ClusterRole, RoleBinding, ClusterRoleBinding) belong to the `rbac.authorization.k8s.io` API group.
Question 3: What happens when `allowPrivilegeEscalation: false` is set in a container's securityContext?
- The container cannot set UID to 0
- The container cannot gain more privileges than its parent process (Correct answer)
- The container runs without any Linux capabilities
- The container is prevented from accessing host networking
Correct answer: The container cannot gain more privileges than its parent process
Setting `allowPrivilegeEscalation: false` prevents a process from gaining more privileges than its parent, blocking setuid and sudo-like escalations.
Question 4: Which Pod Security Standard level is recommended for most workloads requiring some relaxation but still security-conscious?
- privileged
- baseline (Correct answer)
- restricted
- permissive
Correct answer: baseline
The 'baseline' level prevents known privilege escalations while being minimally restrictive, making it suitable for most general workloads.
Question 5: In Kubernetes, what are 'non-resource URLs' in RBAC context?
- URLs for resources that have been deleted
- API endpoints not tied to a Kubernetes resource object, such as /healthz (Correct answer)
- External URLs accessible from cluster Pods
- Endpoints used for webhook authentication
Correct answer: API endpoints not tied to a Kubernetes resource object, such as /healthz
Non-resource URLs are API server endpoints like /healthz, /metrics, and /version that don't correspond to a Kubernetes API resource object.
Question 6: What is the recommended way to provide a Pod with access to the Kubernetes API in modern Kubernetes (1.24+)?
- Mount the cluster admin kubeconfig as a Secret
- Use a ServiceAccount with appropriate RBAC and projected token volumes (Correct answer)
- Grant the Pod host network access
- Use static tokens in the Pod environment variables
Correct answer: Use a ServiceAccount with appropriate RBAC and projected token volumes
The recommended approach is to use a dedicated ServiceAccount with minimal RBAC permissions and projected ServiceAccount tokens for short-lived, audience-bound credentials.
Question 7: Which kubectl command lists all ClusterRoleBindings in a cluster?
- kubectl get rolebindings --all-namespaces
- kubectl get clusterrolebindings (Correct answer)
- kubectl describe bindings --cluster
- kubectl list clusterrolebindings
Correct answer: kubectl get clusterrolebindings
The command `kubectl get clusterrolebindings` lists all ClusterRoleBinding objects, which are cluster-scoped and not namespaced.
KCNA Security and RBAC 4
Which Kubernetes component is responsible for authenticating requests to the API server?