cks-final/submissions/CKS-017-completed-verification-skipped.md

CKS-017 — Remove unnecessary ServiceAccount tokens

Domain: 2.2 Service-account safety
Time: 5 minutes · Score: Section B only

Existing workload

apiVersion: batch/v1
kind: CronJob
metadata:
  name: reporter
  namespace: jobs
spec:
  schedule: "*/10 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: reporter
            image: registry.example.com/reporter:2.1
          restartPolicy: Never

Task

The workload does not use the Kubernetes API. Create a dedicated ServiceAccount named reporter, disable token automounting on it, and update the complete CronJob Pod template to use it and explicitly disable token automounting. Verify the ServiceAccount and CronJob settings.

Section B — scored answer

apiVersion: v1
kind: ServiceAccount
metadata:
  name: reporter
  namespace: jobs
automountServiceAccountToken: false
---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: reporter
  namespace: jobs
spec:
  schedule: "*/10 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          serviceAccountName: reporter
          automountServiceAccountToken: false
          containers:
          - name: reporter
            image: registry.example.com/reporter:2.1
          restartPolicy: Never

k create sa reporter -n jobs --dry-run=client -o yaml > reporter-sa.yaml
kubectl apply -f reporter-sa.yaml

Say Grade CKS-017 when saved.