Kubernetes Container Orchestration Security and RBAC 5 — Questions and Answers
Question 1: What does the Kubernetes API server do when it receives a request from a pod's ServiceAccount that lacks RBAC permissions?
- Returns a 403 Forbidden response (Correct answer)
- Returns a 401 Unauthorized response
- Grants read-only access by default
- Escalates to the cluster-admin role temporarily
Correct answer: Returns a 403 Forbidden response
When a request is authenticated but not authorized by RBAC, the API server returns HTTP 403 Forbidden.
Question 2: Which Kubernetes object should you use to restrict a pod from mounting the host's /etc/passwd file?
- NetworkPolicy
- PodSecurityPolicy or PodSecurity admission (Correct answer)
- ResourceQuota
- LimitRange
Correct answer: PodSecurityPolicy or PodSecurity admission
PodSecurityPolicy (or the newer PodSecurity admission controller) can restrict hostPath volume mounts and prevent access to sensitive host paths.
Question 3: What is the purpose of the 'imagePullSecrets' field in a Pod spec?
- Encrypts the container image at rest
- Provides credentials to pull images from a private container registry (Correct answer)
- Verifies the image signature before running
- Restricts which nodes can pull the image
Correct answer: Provides credentials to pull images from a private container registry
imagePullSecrets references Secret objects containing credentials that the kubelet uses to authenticate with a private image registry.
Question 4: Which Linux capability should be dropped to prevent a container from performing raw packet manipulation?
- CAP_NET_ADMIN
- CAP_SYS_ADMIN
- CAP_NET_RAW (Correct answer)
- CAP_SETUID
Correct answer: CAP_NET_RAW
CAP_NET_RAW allows a process to use raw sockets for packet crafting; dropping it prevents network-based attacks like ARP spoofing.
Question 5: What is 'RBAC impersonation' in Kubernetes and what risk does it pose?
- A method to test pod networking by simulating traffic
- A privilege that allows a user to act as another user, group, or ServiceAccount (Correct answer)
- A way to temporarily elevate permissions for debugging
- An automatic fallback when role bindings are missing
Correct answer: A privilege that allows a user to act as another user, group, or ServiceAccount
RBAC impersonation (the 'impersonate' verb) lets a user make API requests as another identity, which can be exploited for privilege escalation if misconfigured.
Question 6: Which Kubernetes admission controller prevents users from creating pods with images that have not been signed or validated?
- ImagePolicyWebhook (Correct answer)
- PodSecurity
- ValidatingAdmissionWebhook (generic)
- OPA Gatekeeper
Correct answer: ImagePolicyWebhook
ImagePolicyWebhook is a built-in admission controller that delegates image validation to an external webhook for signature and policy checks.
Question 7: What is the effect of setting 'automountServiceAccountToken: false' on a Pod?
- The pod cannot access any Kubernetes resources
- The default ServiceAccount token is not mounted into the pod's filesystem (Correct answer)
- The pod uses an anonymous identity for all API calls
- The pod's network policy is reset to default
Correct answer: The default ServiceAccount token is not mounted into the pod's filesystem
Setting automountServiceAccountToken: false prevents Kubernetes from automatically mounting the ServiceAccount token into the pod at /var/run/secrets/kubernetes.io/serviceaccount.
Kubernetes Container Orchestration Security and RBAC 5
What does the Kubernetes API server do when it receives a request from a pod's ServiceAccount that lacks RBAC permissions?