Skip to content
CKACluster Architecture, Installation & ConfigurationSingle nodeMedium

Cluster-scoped RBAC: ClusterRole for listing nodes

Scenario cka-arc-002 · about 6 minutes · 6 points · 6 grader checks

Grant a namespaced ServiceAccount cluster-wide read access to nodes using a ClusterRole and ClusterRoleBinding.

  • rbac
  • clusterrole
  • clusterrolebinding
  • serviceaccount
  • nodes

What you will practise

  • Distinguish cluster-scoped from namespaced resources
  • Create a ClusterRole and ClusterRoleBinding
  • Bind cluster-scoped permissions to a namespaced ServiceAccount

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cka-arc-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

In the namespace "dev" (create it if it does not exist) make sure a ServiceAccount named "reader" exists. Then: 1. Create a ClusterRole named "node-lister" that allows the verbs get and list on the resource "nodes". 2. Create a ClusterRoleBinding named "node-lister-binding" that binds the ClusterRole "node-lister" to the ServiceAccount "reader" in namespace "dev". The ServiceAccount must end up able to list nodes cluster-wide.

Requirements and details

Certification
CKA · Certified Kubernetes Administrator
Domain
Cluster Architecture, Installation & Configuration
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
6 minutes
Points
6
Grader checks
6
Kubernetes version
1.37
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 6 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Architecture, Installation & Configuration labs

CKACluster Architecture, Installation & ConfigurationMedium

Namespaced RBAC: Role and RoleBinding for a ServiceAccount

Grant a ServiceAccount read access to pods in one namespace using a Role and a RoleBinding.

Single node · ~6 min · 6 points

  • rbac
  • role
  • rolebinding
  • serviceaccount
  • namespace

goldenkube start cka-arc-001

CKACluster Architecture, Installation & ConfigurationMedium

etcd snapshot backup

Take a snapshot of the cluster's etcd datastore and store it as a file on the control plane node.

Single node · ~8 min · 6 points

  • etcd
  • backup
  • etcdctl
  • control-plane

goldenkube start cka-arc-003

CKACluster Architecture, Installation & ConfigurationEasy

Long-lived ServiceAccount token Secret

Create a ServiceAccount and a controller-populated long-lived token Secret bound to it.

Single node · ~6 min · 5 points

  • serviceaccount
  • secret
  • token
  • authentication

goldenkube start cka-arc-004

CKACluster Architecture, Installation & ConfigurationMedium

Static Pod on the control plane

Run a Pod directly through the kubelet by placing a manifest in the static pod directory.

Single node · ~7 min · 6 points

  • static-pod
  • kubelet
  • control-plane
  • manifests

goldenkube start cka-arc-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.