Lesson 0009 · 35 minutes · Minimize Microservice Vulnerabilities

Grant incident access without granting escalation paths

A useful incident identity often needs narrow read access across a namespace. The trap is solving that requirement with a wildcard or by forgetting that logs are a separate subresource.

Exam reflex: translate every requested action into an API resource, verb, and scope. Treat pods/log as distinct from pods, and use resourceNames when the task names a single object.

Timed task: 25 minutes

Apply lab/lesson-9-fixture.yaml. Then create lab/lesson-9-answer.yaml from scratch.

In the incident-response namespace, grant the ServiceAccount audit-bot from namespace security-ops exactly these permissions:

It must not be able to read Secrets, create Pods, execute into Pods, or read any other ConfigMap. Use a namespace-scoped role and binding; do not use a ClusterRole or wildcard resources/verbs.

Verification

kubectl --context kind-cks-lab apply -f .\lab\lesson-9-fixture.yaml
kubectl --context kind-cks-lab apply -f .\lab\lesson-9-answer.yaml
$sa = 'system:serviceaccount:security-ops:audit-bot'
kubectl --context kind-cks-lab auth can-i get pods --as=$sa -n incident-response
kubectl --context kind-cks-lab auth can-i watch pods --as=$sa -n incident-response
kubectl --context kind-cks-lab auth can-i get pods/log --as=$sa -n incident-response
kubectl --context kind-cks-lab auth can-i get configmap/incident-playbook --as=$sa -n incident-response
kubectl --context kind-cks-lab auth can-i get configmap/another-config --as=$sa -n incident-response
kubectl --context kind-cks-lab auth can-i get secrets --as=$sa -n incident-response
kubectl --context kind-cks-lab auth can-i create pods --as=$sa -n incident-response
kubectl --context kind-cks-lab auth can-i create pods/exec --as=$sa -n incident-response

Expected answers, in order: yes yes yes yes no no no no.

Retrieval check

Question

Why does granting get on pods not automatically permit kubectl logs?

Documentation target

Use the official RBAC reference. Confirm the subject format for a cross-namespace ServiceAccount and the behavior of resourceNames.

What to send me

Paste only your Role and RoleBinding YAML, then the eight can-i results. I’ll review least privilege—not merely whether the allowed commands return yes.