Your organization's security policy includes: ServiceAccounts must not automount API credentials ServiceAccount names must end in "-sa" The Pod specified in the manifest file…

Question

Explanation

This question tests the ability to create a Kubernetes ServiceAccount with security hardening (no automounted credentials), correctly reference it in a Pod manifest, and perform namespace hygiene by removing unused ServiceAccounts.

Approach. First, create the ServiceAccount with automountServiceAccountToken: false - either via kubectl create serviceaccount frontend-sa -n qa then patching, or declaratively with a YAML manifest that sets automountServiceAccountToken: false at the ServiceAccount level. Next, inspect /home/candidate/KSCH00301/pod-manifest.yaml to confirm the spec.serviceAccountName field references frontend-sa (and that spec.automountServiceAccountToken is not overriding to true), then apply it with kubectl apply -f. Finally, run kubectl get serviceaccounts -n qa to list all SAs, cross-reference them against running pods with kubectl get pods -n qa -o jsonpath='{.items[*].spec.serviceAccountName}', and kubectl delete serviceaccount <name> -n qa for any SA not referenced by a pod - skipping the default SA and the newly created frontend-sa.

Concept tested. Kubernetes ServiceAccount security hardening (automountServiceAccountToken), namespace-scoped resource management, Pod manifest authoring with correct ServiceAccount binding, and ServiceAccount lifecycle cleanup

Reference. https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting

No community discussion yet for this question.