CKS_FINALE

submissions/CKS-017-completed-verification-skipped.md

@@ -0,0 +1,64 @@
+# CKS-017 — Remove unnecessary ServiceAccount tokens
+
+Domain: **2.2 Service-account safety**  
+Time: **5 minutes** · Score: **Section B only**
+
+## Existing workload
+
+```yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: reporter
+  namespace: jobs
+spec:
+  schedule: "*/10 * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: reporter
+            image: registry.example.com/reporter:2.1
+          restartPolicy: Never
+```
+
+## Task
+
+The workload does not use the Kubernetes API. Create a dedicated ServiceAccount named `reporter`, disable token automounting on it, and update the complete CronJob Pod template to use it and explicitly disable token automounting. Verify the ServiceAccount and CronJob settings.
+
+## Section B — scored answer
+
+```yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: reporter
+  namespace: jobs
+automountServiceAccountToken: false
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: reporter
+  namespace: jobs
+spec:
+  schedule: "*/10 * * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: reporter
+          automountServiceAccountToken: false
+          containers:
+          - name: reporter
+            image: registry.example.com/reporter:2.1
+          restartPolicy: Never
+```
+
+```bash
+k create sa reporter -n jobs --dry-run=client -o yaml > reporter-sa.yaml
+kubectl apply -f reporter-sa.yaml
+```
+
+Say **Grade CKS-017** when saved.