42 lines
836 B
Markdown
42 lines
836 B
Markdown
# CKS-016 — Replace cluster-admin with namespaced RBAC
|
|
|
|
Domain: **2.1 Least-privilege RBAC**
|
|
Time: **5 minutes** · Score: **Section B only**
|
|
|
|
## Existing dangerous binding
|
|
|
|
```yaml
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: maya-admin
|
|
subjects:
|
|
- kind: User
|
|
name: maya
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: cluster-admin
|
|
```
|
|
|
|
## Task
|
|
|
|
Remove this binding. In namespace `blue`, allow user `maya` only to:
|
|
|
|
- `get`, `list`, and `watch` Pods;
|
|
- `get` Pod logs.
|
|
|
|
Create namespaced Role `maya-observer` and RoleBinding `maya-observer`. Include commands that verify one allowed action and that reading Secrets is denied.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
# Commands
|
|
```
|
|
|
|
```yaml
|
|
# Complete Role and RoleBinding
|
|
```
|
|
|
|
Say **Grade CKS-016** when saved.
|