Kubernetes Container Orchestration Security and RBAC 3 — Questions and Answers
Question 1: What is the default behavior of a Kubernetes Secret in terms of encryption at rest?
- Secrets are always encrypted using AES-256
- Secrets are encrypted by default using etcd's built-in encryption
- Secrets are stored as base64-encoded data in etcd without encryption by default (Correct answer)
- Secrets are stored in a separate encrypted key-value store
Correct answer: Secrets are stored as base64-encoded data in etcd without encryption by default
By default, Kubernetes Secrets are only base64-encoded (not encrypted) in etcd; encryption at rest must be explicitly configured.
Question 2: Which admission controller must be enabled for PodSecurityPolicy enforcement?
- ResourceQuota
- LimitRanger
- PodSecurityPolicy (Correct answer)
- NodeRestriction
Correct answer: PodSecurityPolicy
The PodSecurityPolicy admission controller must be enabled in the API server flags for PSPs to be enforced.
Question 3: What does the 'allowPrivilegeEscalation: false' setting do in a container's securityContext?
- Prevents the container from using sudo
- Prevents the container process from gaining more privileges than its parent (Correct answer)
- Disables all Linux capabilities
- Removes the container from the privileged namespace
Correct answer: Prevents the container process from gaining more privileges than its parent
allowPrivilegeEscalation: false ensures a child process cannot gain more privileges than the process that started it.
Question 4: In Kubernetes RBAC, which verb allows a user to watch for changes to resources?
- get
- list
- watch (Correct answer)
- read
Correct answer: watch
The 'watch' verb allows a user to receive streaming notifications of changes to resources via a watch connection.
Question 5: What is a ServiceAccount token's primary purpose in Kubernetes?
- Authenticating external users to the cluster
- Authenticating pods to the Kubernetes API server (Correct answer)
- Encrypting communication between nodes
- Providing SSH access to worker nodes
Correct answer: Authenticating pods to the Kubernetes API server
ServiceAccount tokens are mounted into pods to allow them to authenticate to the Kubernetes API server.
Question 6: Which Kubernetes feature automatically rotates ServiceAccount tokens and makes them short-lived?
- TokenRequest API with projected volumes (Correct answer)
- Secret rotation controller
- RBAC token refresher
- Namespace token expiry policy
Correct answer: TokenRequest API with projected volumes
The TokenRequest API combined with projected service account token volumes provides short-lived, automatically rotated tokens.
Question 7: What is the role of the 'NodeRestriction' admission plugin?
- Prevents nodes from scheduling privileged pods
- Limits kubelet access to only its own node and pod objects (Correct answer)
- Blocks external traffic to NodePort services
- Restricts node labels to approved values
Correct answer: Limits kubelet access to only its own node and pod objects
NodeRestriction limits the API objects a kubelet can modify to only the Node and Pod objects associated with that kubelet.
Kubernetes Container Orchestration Security and RBAC 3
What is the default behavior of a Kubernetes Secret in terms of encryption at rest?