Certified Kubernetes Security Specialist (CKS) - Practice Exam Part 1

1. The buffy Pod in the sunnydale namespace has a buffy-sa ServiceAccount with permissions the Pod doesn't need. Modify the attached Role so that it only has the ability to list pods.
2. Then, create a new Role called watch-services-secrets that grants permission to watch, services, and secrets.
3. Bind the Role to the ServiceAccount with a RoleBinding called buffy-sa-watch-rb.

Note: You can find skeleton manifests for the new role and RoleBinding on the CLI server at:

/home/cloud_user/watch-services-secrets.yml

/home/cloud_user/buffy-sa-watch-rb.yml

A Pod in the cluster cannot be created properly because its ServiceAccount is misconfigured.

1. The Pod is meant to live in the bespin namespace. Delete the existing ServiceAccount from this namespace.
2. Create a new ServiceAccount called lando-sa.
3. Configure the Pod to use the lando-sa ServiceAccount.
4. Create the Pod.

Note: You can find the Pod manifest at /home/cloud_user/lando.yml on the CLI server.