You can switch the cluster/configuration context using the following command: [desk@cli] $ kubectl config use-context prod-account Context: A Role bound to a Pod's ServiceAccount grants overly permiss

This question tests Kubernetes RBAC (Role-Based Access Control) by requiring you to enforce least-privilege access for a Pod's ServiceAccount - editing an existing overly-permissive Role and creating a new scoped Role and RoleBinding.

Submitted by diego_uy· May 5, 2026Cluster Hardening

Question

You can switch the cluster/configuration context using the following command:
[desk@cli] $ kubectl config use-context prod-account
Context: A Role bound to a Pod's ServiceAccount grants overly permissive permissions. Complete the following tasks to reduce the set of permissions.
Task:
Edit the existing Role bound to the Pod's ServiceAccount test-sa to only allow performing get operations, only on resources of type Pods.
Create a new Role named test-role-2 in the namespace database, which only allows performing update operations, only on resources of type statefulsets.
Create a new RoleBinding named test-role-2-bind binding the newly created Role to the Pod's ServiceAccount.
Note: Don't delete the existing RoleBinding.

Explanation

Approach. First, locate the existing Role bound to ServiceAccount 'test-sa' using 'kubectl get rolebinding -A -o yaml | grep -A5 test-sa', then edit that Role ('kubectl edit role <name> -n <namespace>') to set verbs: [get] and resources: [pods], removing any other verbs or resources. Second, create the new Role: 'kubectl create role test-role-2 --verb=update --resource=statefulsets -n database'. Third, create the RoleBinding: 'kubectl create rolebinding test-role-2-bind --role=test-role-2 --serviceaccount=<original-namespace>:test-sa -n database'. The RoleBinding must reference the ServiceAccount with its full namespace prefix (e.g., default:test-sa) since RoleBindings are namespace-scoped but ServiceAccounts live in a specific namespace.

Concept tested. Kubernetes RBAC - editing Roles to enforce least-privilege (principle of minimal permissions), creating namespace-scoped Roles with specific verbs and resources, and binding Roles to ServiceAccounts via RoleBindings without disrupting existing RoleBindings.

Reference. https://kubernetes.io/docs/reference/access-authn-authz/rbac/

Topics

#RBAC#Roles#RoleBindings#ServiceAccounts

Community Discussion

No community discussion yet for this question.

Full CKS Practice