Certified Kubernetes Administrator CKA — Question 1

Topic 1 · Question 1 of 23

Topic 1 · Question 1

SIMULATION - Context - You have been asked to create a new ClusterRole for a deployment pipeline and bind it to a specific ServiceAccount scoped to a specific namespace. Task - Create a new ClusterRole named deployment-clusterrole, which only allows to create the following resource types: • Deployment • Stateful Set • DaemonSet Create a new ServiceAccount named cicd-token in the existing namespace app-team1. Bind the new ClusterRole deployment-clusterrole to the new ServiceAccount cicd-token, limited to the namespace app-team1.

Suggested solution

kubectl create clusterrole deployment-clusterrole --verb=create --resource=deployments,statefulsets,daemonsets
kubectl create serviceaccount cicd-token -n app-team1
kubectl create rolebinding deploy-binding -n app-team1 --clusterrole=deployment-clusterrole --serviceaccount=app-team1:cicd-token
kubectl auth can-i create deployment -n app-team1 --as=system:serviceaccount:app-team1:cicd-token

A RoleBinding grants the ClusterRole only inside app-team1; a ClusterRoleBinding would grant it cluster-wide.

View community discussion →