Skip to content
CKACluster Architecture, Installation & ConfigurationSingle nodeMedium

Namespaced RBAC: Role and RoleBinding for a ServiceAccount

Scenario cka-arc-001 · about 6 minutes · 6 points · 8 grader checks

Grant a ServiceAccount read access to pods in one namespace using a Role and a RoleBinding.

  • rbac
  • role
  • rolebinding
  • serviceaccount
  • namespace

What you will practise

  • Create a ServiceAccount in a namespace
  • Author a Role with specific verbs on a resource
  • Bind a Role to a ServiceAccount with a RoleBinding
  • Verify permissions with kubectl auth can-i

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cka-arc-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

In the namespace "dev" (create it if it does not exist): 1. Create a ServiceAccount named "reader". 2. Create a Role named "pod-reader" that allows the verbs get, list and watch on the resource "pods". 3. Create a RoleBinding named "pod-reader-binding" that binds the Role "pod-reader" to the ServiceAccount "reader". The ServiceAccount must end up able to list pods in "dev".

Requirements and details

Certification
CKA · Certified Kubernetes Administrator
Domain
Cluster Architecture, Installation & Configuration
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
6 minutes
Points
6
Grader checks
8
Kubernetes version
1.37
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 8 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Architecture, Installation & Configuration labs

CKACluster Architecture, Installation & ConfigurationMedium

Cluster-scoped RBAC: ClusterRole for listing nodes

Grant a namespaced ServiceAccount cluster-wide read access to nodes using a ClusterRole and ClusterRoleBinding.

Single node · ~6 min · 6 points

  • rbac
  • clusterrole
  • clusterrolebinding
  • serviceaccount
  • nodes

goldenkube start cka-arc-002

CKACluster Architecture, Installation & ConfigurationMedium

etcd snapshot backup

Take a snapshot of the cluster's etcd datastore and store it as a file on the control plane node.

Single node · ~8 min · 6 points

  • etcd
  • backup
  • etcdctl
  • control-plane

goldenkube start cka-arc-003

CKACluster Architecture, Installation & ConfigurationEasy

Long-lived ServiceAccount token Secret

Create a ServiceAccount and a controller-populated long-lived token Secret bound to it.

Single node · ~6 min · 5 points

  • serviceaccount
  • secret
  • token
  • authentication

goldenkube start cka-arc-004

CKACluster Architecture, Installation & ConfigurationMedium

Static Pod on the control plane

Run a Pod directly through the kubelet by placing a manifest in the static pod directory.

Single node · ~7 min · 6 points

  • static-pod
  • kubelet
  • control-plane
  • manifests

goldenkube start cka-arc-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.