Linux Foundation Exam CKS Topic 4 Question 77 Discussion

Actual exam question for Linux Foundation's CKS exam

Question #: 77
Topic #: 4

[All CKS Questions]

Create a new ServiceAccount named backend-sa in the existing namespace default, which has the capability to list the pods inside the namespace default.

Create a new Pod named backend-pod in the namespace default, mount the newly created sa backend-sa to the pod, and Verify that the pod is able to list pods.

Ensure that the Pod is running.

AExplanation:
A service account provides an identity for processes that run in a Pod.
When you (a human) access the cluster (for example, usingkubectl), you are authenticated by the apiserver as a particular User Account (currently this is usuallyadmin, unless your cluster administrator has customized your cluster). Processes in containers inside pods can also contact the apiserver. When they do, they are authenticated as a particular Service Account (for example,default).
When you create a pod, if you do not specify a service account, it is automatically assigned thedefaultservice account in the same namespace. If you get the raw json or yaml for a pod you have created (for example,kubectl get pods/ -o yaml), you can see thespec.serviceAccountNamefield has beenautomatically set.
You can access the API from inside a pod using automatically mounted service account credentials, as described inAccessing the Cluster. The API permissions of the service account depend on theauthorization plugin and policyin use.
In version 1.6+, you can opt out of automounting API credentials for a service account by settingautomountServiceAccountToken: falseon the service account:
apiVersion: v1
kind: ServiceAccount
metadata:
name: build-robot
automountServiceAccountToken: false
...
In version 1.6+, you can also opt out of automounting API credentials for a particular pod:
apiVersion: v1
kind: Pod
metadata:
name: my-pod
spec:
serviceAccountName: build-robot
automountServiceAccountToken: false
...
The pod spec takes precedence over the service account if both specify aautomountServiceAccountTokenvalue.

Show Suggested Answer

Suggested Answer: A

by Mabelle at Apr 03, 2025, 11:40 AM

Limited Time Offer

25%

Off

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Glenna

13 days ago

This is a pretty straightforward question, but I can imagine it might trip up some people if they're not familiar with how ServiceAccounts work. Good thing we've got this explanation to guide us!

upvoted 0 times

...

Leoma

16 days ago

Wait, do we need to create any specific permissions or Role for the backend-sa ServiceAccount? I don't want to forget that step and end up with a non-working solution.

upvoted 0 times

...

Alethea

28 days ago

Haha, I bet the exam question is going to be something like, 'Which command do you use to list the Pods in the default namespace?' I'm already prepared for that one!

upvoted 0 times

Jina

2 days ago

User 1: I think I know the answer to that question.

upvoted 0 times

...

Val

1 months ago

We should make sure that the Pod is able to list pods by mounting the backend-sa to the pod.

upvoted 0 times

...

23 days ago

Let's start by creating the ServiceAccount backend-sa in the default namespace.

upvoted 0 times

...