65 lines
1.4 KiB
Markdown
65 lines
1.4 KiB
Markdown
# CKS-017 — Remove unnecessary ServiceAccount tokens
|
|
|
|
Domain: **2.2 Service-account safety**
|
|
Time: **5 minutes** · Score: **Section B only**
|
|
|
|
## Existing workload
|
|
|
|
```yaml
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: reporter
|
|
namespace: jobs
|
|
spec:
|
|
schedule: "*/10 * * * *"
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
containers:
|
|
- name: reporter
|
|
image: registry.example.com/reporter:2.1
|
|
restartPolicy: Never
|
|
```
|
|
|
|
## Task
|
|
|
|
The workload does not use the Kubernetes API. Create a dedicated ServiceAccount named `reporter`, disable token automounting on it, and update the complete CronJob Pod template to use it and explicitly disable token automounting. Verify the ServiceAccount and CronJob settings.
|
|
|
|
## Section B — scored answer
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: reporter
|
|
namespace: jobs
|
|
automountServiceAccountToken: false
|
|
---
|
|
apiVersion: batch/v1
|
|
kind: CronJob
|
|
metadata:
|
|
name: reporter
|
|
namespace: jobs
|
|
spec:
|
|
schedule: "*/10 * * * *"
|
|
jobTemplate:
|
|
spec:
|
|
template:
|
|
spec:
|
|
serviceAccountName: reporter
|
|
automountServiceAccountToken: false
|
|
containers:
|
|
- name: reporter
|
|
image: registry.example.com/reporter:2.1
|
|
restartPolicy: Never
|
|
```
|
|
|
|
```bash
|
|
k create sa reporter -n jobs --dry-run=client -o yaml > reporter-sa.yaml
|
|
kubectl apply -f reporter-sa.yaml
|
|
```
|
|
|
|
Say **Grade CKS-017** when saved.
|