Kubernetes Container Orchestration Security and RBAC 4 — Questions and Answers
Question 1: Which RBAC resource grants cluster-wide permissions that apply across all namespaces?
- Role
- ClusterRole (Correct answer)
- NamespaceRole
- GlobalRole
Correct answer: ClusterRole
ClusterRoles define permissions that apply cluster-wide and can be bound to subjects in any namespace or at the cluster level.
Question 2: How can you verify what actions a user 'alice' is allowed to perform on pods in the 'staging' namespace?
- kubectl get roles -n staging --user=alice
- kubectl auth can-i --list --as=alice -n staging (Correct answer)
- kubectl describe permissions alice -n staging
- kubectl check rbac alice -n staging --resource=pods
Correct answer: kubectl auth can-i --list --as=alice -n staging
kubectl auth can-i --list --as=alice -n staging impersonates alice and lists all allowed actions in the staging namespace.
Question 3: What is the effect of setting 'readOnlyRootFilesystem: true' in a container's securityContext?
- Prevents the container from reading any files
- Makes the container's root filesystem immutable (Correct answer)
- Removes write permissions from all mounted volumes
- Enables AppArmor profile enforcement
Correct answer: Makes the container's root filesystem immutable
readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, preventing file modifications to the container layer.
Question 4: Which Kubernetes feature allows you to define allowed syscalls for a container using a profile?
- AppArmor
- Seccomp (Correct answer)
- SELinux
- eBPF tracing
Correct answer: Seccomp
Seccomp (Secure Computing Mode) profiles restrict the system calls a container can make, reducing the attack surface.
Question 5: When a ClusterRoleBinding references a subject of kind 'Group', what does the group 'system:authenticated' represent?
- Only service accounts in the kube-system namespace
- All users who have successfully authenticated to the cluster (Correct answer)
- All users with admin-level roles
- Only users with client certificates
Correct answer: All users who have successfully authenticated to the cluster
system:authenticated is a built-in Kubernetes group that includes every user who has successfully authenticated to the API server.
Question 6: What is the risk of running a container with 'privileged: true' in its securityContext?
- The container cannot access the network
- The container gains near-full access to the host kernel and devices (Correct answer)
- The container runs with a read-only filesystem
- The container is isolated from other pods on the same node
Correct answer: The container gains near-full access to the host kernel and devices
A privileged container disables most namespace isolation and gives the container nearly the same access to the host as a root process on the node.
Question 7: Which tool is commonly used to audit Kubernetes RBAC configurations for misconfigurations and excessive permissions?
- kube-bench
- rbac-police / rakkess (Correct answer)
- kubelet-config
- kube-hunter (network only)
Correct answer: rbac-police / rakkess
Tools like rbac-police, rakkess, and kubectl-who-can are used to audit RBAC permissions and detect overly permissive configurations.
Kubernetes Container Orchestration Security and RBAC 4
Which RBAC resource grants cluster-wide permissions that apply across all namespaces?