QUESTION 29 You must complete this task on the following cluster/nodes: Cluster: immutable-cluster Worker node: worker1 You can switch the cluster/configuration context using the following command…

This question tests your ability to identify and remove Kubernetes Pods that violate stateless/immutable design principles by inspecting volume mounts and security contexts in the 'prod' namespace.

Submitted by weili_xi· May 5, 2026Minimize Microservice Vulnerabilities

Question

QUESTION 29
You must complete this task on the following cluster/nodes: Cluster: immutable-cluster Worker node: worker1
You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context immutable-cluster
Context: It is best practice to design containers to be stateless and immutable.
Task: Inspect Pods running in namespace prod and delete any Pod that is either not stateless or not immutable.
Use the following strict interpretation of stateless and immutable:
Pods being able to store data inside containers must be treated as not stateless. Note: You don't have to worry whether data is actually stored inside containers or not already.
Pods being configured to be privileged in any way must be treated as potentially not stateless or not immutable.

Explanation

This question tests your ability to identify and remove Kubernetes Pods that violate stateless/immutable design principles by inspecting volume mounts and security contexts in the 'prod' namespace.

Approach. Switch context with 'kubectl config use-context immutable-cluster', then run 'kubectl get pods -n prod -o yaml' to inspect all pod specs. Delete any pod that has volumes capable of writing data inside the container (e.g., emptyDir, hostPath, or writable volumeMounts with no readOnly: true) - these violate statelessness. Also delete any pod with a privileged security configuration such as securityContext.privileged: true, allowPrivilegeEscalation: true, dangerous capability additions (securityContext.capabilities.add), runAsUser: 0 (root), or pod-level settings like hostPID: true, hostIPC: true, or hostNetwork: true - these violate immutability. Use 'kubectl delete pod <name> -n prod' for each offending pod.

Concept tested. Kubernetes Pod security and design principles: identifying pods that break the stateless (no local data storage) and immutable (no privileged access) contract by auditing volumeMounts, volume types, and securityContext fields at both the pod and container level.

Reference. https://kubernetes.io/docs/concepts/security/pod-security-standards/ and https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

Topics

#Pod Security#Container Best Practices#Immutability#Statelessness

Community Discussion

No community discussion yet for this question.

Full CKS Practice