Given an existing Pod named web-pod running in the namespace security. Edit the existing Role bound to the Pod's ServiceAccount sa-dev-1 to only allow performing watch operations, only on resources…

Question

Explanation

This question tests Kubernetes RBAC (Role-Based Access Control) by requiring you to inspect a running Pod's ServiceAccount, modify an existing Role's permissions, and create a new Role and RoleBinding - all within a specific namespace.

Approach. First, inspect the Pod to find its ServiceAccount: kubectl get pod web-pod -n security -o jsonpath='{.spec.serviceAccountName}' (should return sa-dev-1). Then find the existing Role bound to sa-dev-1 via kubectl get rolebindings -n security -o wide and edit it with kubectl edit role <existing-role> -n security, replacing its rules with verbs: [watch] and resources: [services] under apiGroups: [""]. Next, create role-2 with kubectl create role role-2 -n security --verb=update --resource=namespaces, then bind it with kubectl create rolebinding role-2-binding -n security --role=role-2 --serviceaccount=security:sa-dev-1. The existing RoleBinding must remain untouched - only the Role it references gets its rules overwritten.

Concept tested. Kubernetes RBAC - specifically: reading Pod specs to trace ServiceAccount ownership, editing existing Role rules (verbs/resources/apiGroups), creating namespace-scoped Roles and RoleBindings, and understanding that multiple RoleBindings can coexist for the same ServiceAccount without conflict.

Reference. https://kubernetes.io/docs/reference/access-authn-authz/rbac/

No community discussion yet for this question.