Skip to content
CKSCluster HardeningSingle nodeMedium

RBAC: replace cluster-admin with a namespaced Role

Scenario cks-hrd-001 · about 8 minutes · 9 points · 8 grader checks

A CI ServiceAccount was given cluster-wide power; remove the bindings and grant a minimal namespaced Role instead.

  • rbac
  • least-privilege
  • serviceaccount
  • clusterrolebinding
  • cluster-hardening

What you will practise

  • Find every ClusterRoleBinding that references a subject
  • Write a namespaced Role for two API groups
  • Audit the result with kubectl auth can-i --as

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-hrd-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

The ServiceAccount "pipeline" in namespace "ci" is used by a CI system. Somebody granted it far more than it needs through ClusterRoleBindings. 1. Remove every ClusterRoleBinding that grants anything to the ServiceAccount ci:pipeline. Do not delete the ServiceAccount and do not modify ClusterRoleBindings that do not mention it. 2. Create a Role "pipeline-deployer" in "ci" that allows get, list, watch, create, update and patch on deployments (API group "apps") and get, list and watch on pods. 3. Bind it to the ServiceAccount with a RoleBinding "pipeline-deployer" in "ci". Afterwards ci:pipeline may only do what the Role allows in "ci" and nothing anywhere else.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Cluster Hardening
Difficulty
Medium
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
9
Grader checks
8
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 8 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Hardening labs

CKSCluster HardeningEasy

ServiceAccounts: stop mounting unused API tokens

Disable token automounting on the default and a dedicated ServiceAccount and move a running Deployment onto it.

Single node · ~7 min · 8 points

  • serviceaccount
  • automount
  • token
  • deployment
  • cluster-hardening

goldenkube start cks-hrd-002

CKSCluster HardeningHard

Restrict the API server: authorization and NodeRestriction

The API server authorizes every request and lets kubelets edit any node; restore Node,RBAC authorization and the NodeRestriction admission plugin.

Single node · ~9 min · 8 points

  • kube-apiserver
  • authorization
  • admission
  • noderestriction
  • static-pod

goldenkube start cks-hrd-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.