Kubernetes Container Orchestration Security and RBAC 4

Question 1

Which RBAC resource grants cluster-wide permissions that apply across all namespaces?

Accepted Answer

ClusterRole

Answer

ClusterRoles define permissions that apply cluster-wide and can be bound to subjects in any namespace or at the cluster level.

Question 2

How can you verify what actions a user 'alice' is allowed to perform on pods in the 'staging' namespace?

Accepted Answer

kubectl auth can-i --list --as=alice -n staging

Answer

kubectl auth can-i --list --as=alice -n staging impersonates alice and lists all allowed actions in the staging namespace.

Question 3

What is the effect of setting 'readOnlyRootFilesystem: true' in a container's securityContext?

Accepted Answer

Makes the container's root filesystem immutable

Answer

readOnlyRootFilesystem: true mounts the container's root filesystem as read-only, preventing file modifications to the container layer.

Question 4

Which Kubernetes feature allows you to define allowed syscalls for a container using a profile?

Accepted Answer

Seccomp

Answer

Seccomp (Secure Computing Mode) profiles restrict the system calls a container can make, reducing the attack surface.

Question 5

When a ClusterRoleBinding references a subject of kind 'Group', what does the group 'system:authenticated' represent?

Accepted Answer

All users who have successfully authenticated to the cluster

Answer

system:authenticated is a built-in Kubernetes group that includes every user who has successfully authenticated to the API server.

Kubernetes Container Orchestration Practice Test