Lesson in CKA Mock Exam
Question 8: ServiceAccount, Role, and RoleBinding
Create a ServiceAccount that can only create Secrets and ConfigMaps in one namespace, nothing else.
Create a new ServiceAccount processor in Namespace project-hamster. Create a Role and RoleBinding, both named processor as well. These should allow the new SA to only create Secrets and ConfigMaps in that Namespace.
Hint 1
kubectl auth can-i --as=<something> lets you test permissions from any identity without actually needing to authenticate as it — useful for checking your own work before considering the task done.
Hint 2
"Only create" is two constraints, not one: the verb list needs to be narrow (not just non-empty), and double check you haven't reached for a Cluster-scoped variant of either object by habit.
- Previous lesson
- Question 7: DaemonSet with Resource Requests
- Next lesson
- Question 9: Query Secrets from Inside a Pod