MENU
Context
A Role bound to a Pod's ServiceAccount grants overly permissive permissions. Complete the following tasks to reduce the set of permissions.
Task
Given an existing Pod named web-pod running in the namespace security.
Edit the existing Role bound to the Pod's ServiceAccount sa-dev-1 to only allow performing watch operations, only on resources of type services.
Create a new Role named role-2 in the namespace security, which only allows performing update
operations, only on resources of type namespaces.
Create a new RoleBinding named role-2-binding binding the newly created Role to the Pod's ServiceAccount.
Suggested Answer: A
Get Premium CKS Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
28 comments · newest first
AR
Arlean
7 months ago
Yes, role-2 for namespaces is crucial. Good catch!
VE
Velda
7 months ago
But we also need to create that new Role, right?
EL
Elina
7 months ago
Agreed. Watch operations are safer for services.
DE
Denny
8 months ago
I think option A is the best choice. It limits access well.
VA
Vannessa
8 months ago
I feel the same. Need to focus on the specifics.
GE
Gearldine
8 months ago
Sounds good, but are we sure this won't break anything?
JO
Jolene
8 months ago
Wait, we can create a Role for namespaces? That’s new to me!
SU
Susana
9 months ago
Totally agree, less is more when it comes to permissions!
AN
Annamaria
9 months ago
Just need to limit permissions to watch services only.
BO
Bobbie
9 months ago
Wait, we have to create a new Role and RoleBinding? That's a lot of steps.
DI
Dick
9 months ago
Haha, I bet the exam writer had a good laugh coming up with this one.
LA
Laquita
9 months ago
Hmm, I'm not sure about the namespace update permission. Seems a bit overkill.
SA
Santos
10 months ago
This looks straightforward, I think I can handle it.
RO
Ronnie
10 months ago
I recall that we had to bind Roles to ServiceAccounts in a previous exercise. I hope I can remember the steps to create the RoleBinding correctly.
ST
Stanford
10 months ago
I think I need to look up the exact syntax for defining permissions in a Role. I feel like I might mix up the resource types.
AN
An
10 months ago
This seems like a good opportunity to demonstrate my RBAC knowledge. I'm confident I can complete all the tasks efficiently and accurately. I'll make sure to follow the exact requirements and pay close attention to the details.
DE
Denise
10 months ago
Okay, let's break this down step-by-step. First, I'll edit the existing Role to only allow watch operations on services. Then, I'll create a new Role for updating namespaces and bind it to the Pod's ServiceAccount. I think I can handle this, but I'll double-check my work before submitting.
DO
Doretha
10 months ago
This question is tricky. Permissions can get complicated.
BR
Brett
11 months ago
This seems similar to that practice question where we had to create a RoleBinding. I think I can manage that part, but the specifics on namespaces are a bit fuzzy.
ER
Eric
11 months ago
I remember we practiced editing Roles before, but I'm not entirely sure how to limit permissions specifically to watch operations.
JO
Jovita
11 months ago
I think updating namespaces is a bit risky, but okay.
NE
Nenita
11 months ago
Hmm, I'm a bit unsure about the specifics of the RBAC resources and their interactions. I'll need to carefully read through the question and make sure I understand the expected changes before attempting to implement them.
DE
Delmy
12 months ago
This looks like a straightforward RBAC question. I'll start by reviewing the existing Role bound to the Pod's ServiceAccount and then create a new Role and RoleBinding as per the requirements.
JA
James
6 months ago
And we must bind it to sa-dev-1 with role-2-binding.
DA
Dahlia
6 months ago
Don't forget to create role-2 for updating namespaces!
LE
Lelia
7 months ago
After that, we can edit it for watch operations on services.
ED
Edda
7 months ago
Let's check the current Role for the web-pod.
DE
Delisa
11 months ago
Good idea! We need to see what permissions it has.