4 lines
1.2 KiB
HTML
4 lines
1.2 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>CKS-017 · ServiceAccount Safety</title><link rel="stylesheet" href="../assets/course.css"></head><body><main class="page">
|
|
<header class="hero"><p class="eyebrow">CKS Security Quest · Service accounts</p><h1>Remove unnecessary API tokens</h1><p class="deck">A dedicated identity with token automounting disabled at both layers.</p><div class="meta"><span class="pill">CKS-017</span><span class="pill">5 minutes</span></div></header>
|
|
<div class="layout"><section class="card"><h2>Task</h2><p>Namespace <code>jobs</code> contains CronJob <code>reporter</code>, which does not use the Kubernetes API.</p><ol class="requirements"><li>Create dedicated ServiceAccount <code>reporter</code>.</li><li>Disable automounting on the ServiceAccount.</li><li>Use it in the complete CronJob Pod template and explicitly disable automounting there.</li><li>Apply and verify both settings.</li></ol></section><aside class="rail card"><p class="eyebrow">Mission</p><h2>Least token exposure</h2><a class="button" href="../ANSWER.md">Open answer file</a><a class="button" href="../dashboard.html">Quest dashboard</a></aside></div></main></body></html>
|