Skip to content
CKSCluster HardeningSingle nodeEasy

ServiceAccounts: stop mounting unused API tokens

Scenario cks-hrd-002 · about 7 minutes · 8 points · 6 grader checks

Disable token automounting on the default and a dedicated ServiceAccount and move a running Deployment onto it.

  • serviceaccount
  • automount
  • token
  • deployment
  • cluster-hardening

What you will practise

  • Disable automountServiceAccountToken on a ServiceAccount
  • Switch a Deployment to a dedicated ServiceAccount
  • Confirm that no projected token volume reaches the pods

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-hrd-002

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

In namespace "payments" the Deployment "api" (2 replicas, image nginx:1.27) runs with the "default" ServiceAccount and every pod gets an API token it never uses. 1. Change the ServiceAccount "default" in "payments" so that its token is not mounted into pods automatically. 2. Create a ServiceAccount "payments-api" in "payments" that does not automount its token either. 3. Make the Deployment "api" run with the ServiceAccount "payments-api" (edit it, do not recreate it). When you are done, no running "api" pod may contain a ServiceAccount token, and both replicas must be Ready.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Cluster Hardening
Difficulty
Easy
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
7 minutes
Points
8
Grader checks
6
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 6 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Hardening labs

CKSCluster HardeningMedium

RBAC: replace cluster-admin with a namespaced Role

A CI ServiceAccount was given cluster-wide power; remove the bindings and grant a minimal namespaced Role instead.

Single node · ~8 min · 9 points

  • rbac
  • least-privilege
  • serviceaccount
  • clusterrolebinding
  • cluster-hardening

goldenkube start cks-hrd-001

CKSCluster HardeningHard

Restrict the API server: authorization and NodeRestriction

The API server authorizes every request and lets kubelets edit any node; restore Node,RBAC authorization and the NodeRestriction admission plugin.

Single node · ~9 min · 8 points

  • kube-apiserver
  • authorization
  • admission
  • noderestriction
  • static-pod

goldenkube start cks-hrd-003

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.