CKAD · Question #23
Modify the existing Deployment named broker-deployment running in namespace quetzal so that its containers: 1) Run with user ID 30000 and 2) Privilege escalation is forbidden The broker-deployment…
This question tests your ability to configure Kubernetes Security Contexts on a Deployment to enforce container-level security constraints such as running as a specific non-root user and preventing privilege escalation.
Question
- Run with user ID 30000 and
- Privilege escalation is forbidden The broker-deployment is manifest file can be found at: /during_exam/cka/broker-deployment.yaml
Explanation
This question tests your ability to configure Kubernetes Security Contexts on a Deployment to enforce container-level security constraints such as running as a specific non-root user and preventing privilege escalation.
Approach. Edit /during_exam/cka/broker-deployment.yaml and add a securityContext block under the containers[*] spec (not the Pod spec) with runAsUser: 30000 and allowPrivilegeEscalation: false. The correct location is inside spec.template.spec.containers[].securityContext, not spec.template.spec.securityContext (which is pod-level). After editing the file, apply it with kubectl apply -f /during_exam/cka/broker-deployment.yaml and verify with kubectl get deployment broker-deployment -n quetzal -o yaml or kubectl exec into a pod and run id to confirm UID 30000.
Concept tested. Kubernetes Security Contexts - specifically container-level securityContext.runAsUser (forces the container process to run as a specific UID) and securityContext.allowPrivilegeEscalation: false (prevents the process from gaining more privileges than its parent, e.g., via setuid binaries or sudo). Distinguishing between pod-level and container-level securityContext is a common exam pitfall.
Reference. https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
Topics
Community Discussion
No community discussion yet for this question.