Skip to content
CKADApplication Environment, Configuration and SecuritySingle nodeMedium

ServiceAccount with least-privilege RBAC for an app

Scenario ckad-env-004 · about 8 minutes · 10 points · 10 grader checks

Give an application its own ServiceAccount with a namespaced Role and switch a running Deployment to it.

  • serviceaccount
  • rbac
  • role
  • rolebinding
  • deployment

What you will practise

  • Create a ServiceAccount and a namespaced Role for an API group
  • Bind a Role to a ServiceAccount
  • Run a Deployment with a specific serviceAccountName
  • Check permissions with kubectl auth can-i --as

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start ckad-env-004

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

In namespace "rbac-app" a Deployment "dashboard" (image nginx:1.27) runs with the default ServiceAccount. The application needs to manage Deployments in its own namespace and nothing else. 1. Create a ServiceAccount "deployer" in "rbac-app". 2. Create a Role "deploy-manager" that allows get, list, watch, create, update and patch on deployments (API group "apps") in "rbac-app". 3. Bind the Role to the ServiceAccount with a RoleBinding "deployer-binding". 4. Make the Deployment "dashboard" run its pods with the ServiceAccount "deployer" (edit it, do not recreate it). The ServiceAccount must not be able to delete Deployments or read Secrets. "dashboard" must have its replica Ready with the new ServiceAccount.

Requirements and details

Certification
CKAD · Certified Kubernetes Application Developer
Domain
Application Environment, Configuration and Security
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
10
Grader checks
10
Kubernetes version
1.37
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 10 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Application Environment, Configuration and Security labs

CKADApplication Environment, Configuration and SecurityEasy

ConfigMap and Secret as env vars and a volume

Create a ConfigMap and a Secret and consume them in a Pod as single env vars, envFrom and a mounted volume.

Single node · ~7 min · 9 points

  • configmap
  • secret
  • env
  • envfrom
  • volumes

goldenkube start ckad-env-001

CKADApplication Environment, Configuration and SecurityMedium

Pod and container SecurityContext

Run a Pod as a non-root user with a read-only root filesystem, no privilege escalation and no capabilities.

Single node · ~7 min · 11 points

  • securitycontext
  • runasnonroot
  • capabilities
  • readonlyrootfilesystem
  • pod

goldenkube start ckad-env-002

CKADApplication Environment, Configuration and SecurityMedium

Requests, limits, LimitRange and ResourceQuota

Constrain a namespace with a ResourceQuota and LimitRange defaults, then deploy a workload that fits inside them.

Single node · ~8 min · 10 points

  • resources
  • requests
  • limits
  • resourcequota
  • limitrange

goldenkube start ckad-env-003

CKADApplication Environment, Configuration and SecurityEasy

Use a CustomResourceDefinition

Discover the schema of a custom resource and create and update objects of that kind with kubectl.

Single node · ~6 min · 8 points

  • crd
  • custom-resource
  • api-resources
  • kubectl-explain

goldenkube start ckad-env-005

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.