You must complete this task on the following cluster/nodes: Cluster: immutable-cluster Worker node: worker1 Context: It is best practice to design containers to be stateless and immutable. Task: Inspe

This task tests your ability to identify and remove Kubernetes Pods in a namespace that violate stateless and immutable container design principles, specifically by inspecting pod security contexts for writable filesystems or privileged configurations.

Submitted by anna_se· May 4, 2026Minimize Microservice Vulnerabilities

Question

You must complete this task on the following cluster/nodes: Cluster: immutable-cluster Worker node: worker1 Context: It is best practice to design containers to be stateless and immutable. Task: Inspect Pods running in namespace prod and delete any Pod that is either not stateless or not immutable. Use the following strict interpretation of stateless and immutable: 1. Pods being able to store data inside containers must be treated as not stateless. Note: You don't have to worry whether data is actually stored inside containers or not already. 2. Pods being configured to be privileged in any way must be treated as potentially not stateless or not immutable.

Explanation

Approach. First, switch to the correct cluster context with kubectl config use-context immutable-cluster, then list all pods in the prod namespace with kubectl get pods -n prod. For each pod, run kubectl get pod <name> -n prod -o yaml and inspect the securityContext at both the pod and container levels. Delete any pod where readOnlyRootFilesystem is false or not set (meaning data CAN be stored inside the container, violating stateless), OR where privileged: true, allowPrivilegeEscalation: true, or dangerous capabilities.add entries are present (violating immutability). Use kubectl delete pod <name> -n prod for each offending pod.

Concept tested. Kubernetes Pod Security Context - specifically enforcing stateless design via readOnlyRootFilesystem: true and immutability via disabling privileged, allowPrivilegeEscalation, and added Linux capabilities. This maps to CKS exam domain: 'Minimize Microservice Vulnerabilities' and the broader principle that containers should be treated as cattle, not pets - ephemeral, read-only, and non-privileged.

Reference. Kubernetes Docs: Configure a Security Context for a Pod or Container - https://kubernetes.io/docs/tasks/configure-pod-container/security-context/

Topics

#Pod SecurityContext#Stateless Containers#Immutable Infrastructure#kubectl

Community Discussion

No community discussion yet for this question.

Full CKS Practice