Lesson in CKA Mock Exam
Question 9: Query Secrets from Inside a Pod
Use a Pod's ServiceAccount token to query the Kubernetes API directly with curl, and save the result.
There is ServiceAccount secret-reader in Namespace project-swan. Create a Pod of image nginx:1-alpine named api-contact which uses this ServiceAccount.
Exec into the Pod and use curl to manually query all Secrets from the Kubernetes API:
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
curl -k https://kubernetes.default/api/v1/secrets -H "Authorization: Bearer ${TOKEN}"
Write the full result into /opt/course/9/result.json on the node, not inside the Pod.
Hint
kubectl exec streams whatever the container writes to stdout back to your own terminal — that's enough to get a file's contents out of a Pod and into a file on the node, without needing kubectl cp. Something like: kubectl -n project-swan exec api-contact -- cat result.json > /opt/course/9/result.json (after you've curled the output into result.json inside the container first).
- Previous lesson
- Question 8: ServiceAccount, Role, and RoleBinding