Kubernetes Container Orchestration Security and RBAC 2 — Questions and Answers
Question 1: Which Kubernetes object binds a ClusterRole to a user within a specific namespace?
- ClusterRoleBinding
- RoleBinding (Correct answer)
- Role
- NetworkPolicy
Correct answer: RoleBinding
A RoleBinding grants the permissions defined in a ClusterRole or Role to a user within a specific namespace.
Question 2: What does the 'principle of least privilege' mean in Kubernetes RBAC?
- Grant all permissions by default and revoke as needed
- Grant only the minimum permissions required to perform a task (Correct answer)
- Use ClusterRoles instead of Roles for simplicity
- Allow all service accounts to access the API server
Correct answer: Grant only the minimum permissions required to perform a task
Least privilege means granting only the permissions necessary for a user or service account to perform its intended function.
Question 3: Which field in a Pod spec allows you to run a container as a non-root user?
- securityContext.runAsNonRoot (Correct answer)
- podSpec.nonRoot
- containerSpec.rootless
- securityPolicy.noRoot
Correct answer: securityContext.runAsNonRoot
Setting securityContext.runAsNonRoot: true prevents the container from running as the root user (UID 0).
Question 4: What is the purpose of a Kubernetes NetworkPolicy?
- Encrypt data at rest in etcd
- Control ingress and egress traffic between pods (Correct answer)
- Assign RBAC roles to namespaces
- Manage TLS certificates for the API server
Correct answer: Control ingress and egress traffic between pods
NetworkPolicy resources define rules that control which pods can communicate with each other and with external endpoints.
Question 5: Which command shows the RBAC permissions of a specific service account?
- kubectl get permissions <sa>
- kubectl auth can-i --list --as=system:serviceaccount:<ns>:<sa> (Correct answer)
- kubectl describe rbac <sa>
- kubectl show roles <sa>
Correct answer: kubectl auth can-i --list --as=system:serviceaccount:<ns>:<sa>
kubectl auth can-i --list with the --as flag impersonates the service account and lists all allowed verbs and resources.
Question 6: What happens to a Pod that tries to use a PodSecurityPolicy that it is not authorized to use?
- The pod runs with default security settings
- The pod is admitted but logged
- The pod creation is rejected by the admission controller (Correct answer)
- The pod runs in a restricted namespace
Correct answer: The pod creation is rejected by the admission controller
The PodSecurityPolicy admission controller rejects pod creation if the pod does not satisfy any authorized PSP.
Question 7: Which Kubernetes resource type can be used to store sensitive data such as passwords and tokens?
- ConfigMap
- Secret (Correct answer)
- PersistentVolume
- Annotation
Correct answer: Secret
Secrets are Kubernetes objects designed to hold small amounts of sensitive data like passwords, tokens, and keys.
Kubernetes Container Orchestration Security and RBAC 2
Which Kubernetes object binds a ClusterRole to a user within a specific namespace?