A security audit has identified a Deployment improperly handling service account tokens, which could lead to security vulnerabilities. First, modify the existing ServiceAccount stats-monitor-sa in the

Question

Explanation

1. Connect to correct host ssh cks000033 sudo -i export KUBECONFIG=/etc/kubernetes/admin.conf

2. Patch the ServiceAccount to disable automounting Task: Turn off automounting of API credentials for stats-monitor-sa in monitoring. kubectl -n monitoring patch sa stats-monitor-sa -p '{"automountServiceAccountToken": false}' Verify: kubectl -n monitoring get sa stats-monitor-sa -o yaml | grep -i automount

3. Edit the Deployment manifest file Task says to modify the manifest at: /home/candidate/stats-monitor/deployment.yaml vi /home/candidate/stats-monitor/deployment.yaml

4. In the Deployment, ensure it uses the ServiceAccount AND inject token via a Projected Volume 4.1 Make sure Deployment uses the SA Under: spec: -> template: -> spec: ensure: serviceAccountName: stats-monitor-sa (if it already exists, leave it; don't add extra changes beyond requirements.)

4.2 Add a projected volume named token Under: spec: -> template: -> spec: -> volumes: add (or modify existing volume if present) so it is exactly:

• name: token projected: sources:
  • serviceAccountToken: path: token This creates the file token inside the mounted directory, so the final path becomes: /var/run/secrets/kubernetes.io/serviceaccount/token

4.3 Mount the projected volume read-only at the required location Under the target container: spec: -> template: -> spec: -> containers: -> (your container) -> volumeMounts: Add:

• name: token mountPath: /var/run/secrets/kubernetes.io/serviceaccount readOnly: true

This satisfies: Projected volume name: token Mount path: /var/run/secrets/kubernetes.io/serviceaccount/token (file inside mount) Mounted read-only

4.4 Important: Don't break default token mount behavior Because you disabled SA automounting at the ServiceAccount level, you must explicitly mount the projected token (done above). That's the whole point of this task. Save and exit: :wq

1. Apply the updated Deployment kubectl -n monitoring apply -f /home/candidate/stats-monitor/deployment.yaml Wait rollout: kubectl -n monitoring rollout status deployment/stats-monitor

2. Verify the token file exists in the running Pod Get a pod name: POD=$(kubectl -n monitoring get pods -l app=stats-monitor -o jsonpath='{.items[0].metadata.name}') echo $POD Check the token file path exists: kubectl -n monitoring exec -it $POD -- ls -l /var/run/secrets/kubernetes.io/serviceaccount/token Optional: confirm it's mounted read-only (usually shown by mount options): kubectl -n monitoring exec -it $POD -- mount | grep /var/run/secrets/kubernetes.io/serviceaccount

What the examiner checks SA stats-monitor-sa has: automountServiceAccountToken: false Deployment stats-monitor mounts a projected volume named token

No community discussion yet for this question.