Service accounts can be a useful tool in Kubernetes, but they could become a security risk if their permissions are too broad. In this lab, you will practice your Kubernetes security skills by restricting permissions for a service account to only those that are necessary.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create a Service Account with Appropriate Permissions for the pod-watch Pod
The
pod-watchPod in theauthnamespace needs to be able to get and list Pods and Pod logs in theauthnamespace.Create a service account called
pod-monitorand assign it appropriate RBAC permissions for thepod-watchPod.Modify the
pod-watchPod to use the new service account. Note that you will need to delete and re-create the Pod to do this. A manifest for the Pod can be found in/home/cloud_user.- Create a Service Account with Appropriate Permissions for the svc-watch Pod
The
svc-watchPod in theauthnamespace needs to be able to get and list Services and Endpoints in theauthnamespace.Create a service account called
svc-monitorin theauthnamespace and assign it appropriate RBAC permissions for thesvc-watchPod.Modify the
svc-watchPod to use the new service account. Note that you will need to delete and re-create the Pod to this. A manifest for the Pod can be found in/home/cloud_user.- Delete the Old Shared Service Account
Delete the old
auth-saservice account that these Pods were using previously.
