> For the complete documentation index, see [llms.txt](https://atomoh.gitbook.io/kubernetes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://atomoh.gitbook.io/kubernetes/en/quiz-collection/security-and-policy/02-kubernetes-auth-authz-quiz.md).
# Kubernetes Authentication and Authorization Quiz
> **Related Document**: [Kubernetes Authentication and Authorization System](/kubernetes/en/security-and-policy/02-kubernetes-auth-authz.md)
## Multiple Choice Questions
### 1. In Kubernetes X.509 certificate authentication, from which field is the username extracted?
* A) Subject Alternative Name (SAN)
* B) Common Name (CN)
* C) Organization Unit (OU)
* D) Issuer
Show Answer
**Answer: B) Common Name (CN)**
**Explanation:** In X.509 certificates, the Common Name (CN) maps to the username, and the Organization (O) maps to groups.
### 2. What is the main difference between ClusterRole and Role in RBAC?
* A) ClusterRole is read-only, Role is read/write
* B) ClusterRole is cluster-wide scope, Role is namespace scope
* C) ClusterRole is admin-only, Role is for regular users
* D) ClusterRole applies to nodes only, Role applies to pods only
Show Answer
**Answer: B) ClusterRole is cluster-wide scope, Role is namespace scope**
**Explanation:** Role defines permissions for resources within a specific namespace, while ClusterRole defines permissions for cluster-wide resources or non-namespaced resources.
### 3. What is the default path where ServiceAccount tokens are automatically mounted in pods?
* A) /var/run/secrets/kubernetes.io/token
* B) /etc/kubernetes/serviceaccount
* C) /var/run/secrets/kubernetes.io/serviceaccount
* D) /opt/kubernetes/secrets
Show Answer
**Answer: C) /var/run/secrets/kubernetes.io/serviceaccount**
**Explanation:** ServiceAccount tokens are mounted by default at `/var/run/secrets/kubernetes.io/serviceaccount`.
### 4. What is the execution order of MutatingAdmissionWebhook and ValidatingAdmissionWebhook?
* A) Validating first, then Mutating
* B) Mutating first, then Validating
* C) Executed in parallel simultaneously
* D) Executed randomly without order
Show Answer
**Answer: B) Mutating first, then Validating**
**Explanation:** Admission controller execution order: 1) MutatingAdmissionWebhook (modifies requests), 2) ValidatingAdmissionWebhook (validates requests).
### 5. What ConfigMap maps IAM users/roles to Kubernetes RBAC in EKS?
* A) kube-config
* B) aws-auth
* C) eks-iam-mapping
* D) cluster-auth
Show Answer
**Answer: B) aws-auth**
**Explanation:** In Amazon EKS, the `aws-auth` ConfigMap (in kube-system namespace) maps AWS IAM users and roles to Kubernetes users and groups.
### 6. Which authentication method is recommended for production Kubernetes clusters?
* A) Static token file
* B) Basic authentication
* C) OIDC (OpenID Connect)
* D) Anonymous authentication
Show Answer
**Answer: C) OIDC (OpenID Connect)**
**Explanation:** OIDC provides enterprise-grade authentication with features like token expiration, refresh tokens, and integration with identity providers like Okta, Azure AD, and Google.
### 7. What is the purpose of the `system:masters` group in Kubernetes?
* A) To manage master nodes
* B) To provide cluster-admin privileges
* C) To schedule pods on master nodes
* D) To manage system namespaces
Show Answer
**Answer: B) To provide cluster-admin privileges**
**Explanation:** The `system:masters` group is bound to the `cluster-admin` ClusterRole, granting full administrative access to the cluster.
### 8. How do you restrict a ServiceAccount to only read pods in a specific namespace?
* A) ClusterRole + ClusterRoleBinding
* B) Role + ClusterRoleBinding
* C) ClusterRole + RoleBinding
* D) Role + RoleBinding
Show Answer
**Answer: D) Role + RoleBinding**
**Explanation:** For namespace-scoped permissions, use a Role (defines permissions within a namespace) with a RoleBinding (binds the role to a subject within the same namespace).
### 9. What is the purpose of the `impersonate` verb in RBAC?
* A) To create fake resources
* B) To allow a user to act as another user or group
* C) To duplicate resources
* D) To mask resource names
Show Answer
**Answer: B) To allow a user to act as another user or group**
**Explanation:** The `impersonate` verb allows a user to perform actions as if they were another user, group, or ServiceAccount. This is useful for debugging and administrative purposes.
### 10. Which file contains the ServiceAccount token in a mounted volume?
* A) ca.crt
* B) namespace
* C) token
* D) serviceaccount.json
Show Answer
**Answer: C) token**
**Explanation:** The ServiceAccount volume mount contains three files: `ca.crt` (CA certificate), `namespace` (current namespace), and `token` (JWT token for authentication).
## Short Answer Questions
### 1. What is the main difference between user accounts and service accounts in Kubernetes?
Show Answer
**Answer: User accounts are managed externally and not directly managed by Kubernetes, while service accounts are namespace-scoped resources managed through the Kubernetes API.**
### 2. How do you disable automatic ServiceAccount token mounting?
Show Answer
**Answer: Set `automountServiceAccountToken: false` in either the ServiceAccount or Pod spec.**
### 3. What is the difference between `rules` and `aggregationRule` in a ClusterRole?
Show Answer
**Answer: `rules` directly defines permissions, while `aggregationRule` automatically combines permissions from other ClusterRoles that match specific labels.**
**Explanation:** Aggregated ClusterRoles are useful for extending built-in roles without modifying them directly.
### 4. What is the TokenRequest API and why is it preferred over static tokens?
Show Answer
**Answer: TokenRequest API creates time-limited, audience-bound tokens that are more secure than long-lived static tokens.**
**Explanation:** Tokens from TokenRequest API expire automatically and are bound to specific audiences, reducing the risk of token theft and misuse.
### 5. How does Kubernetes determine which authentication method to use when multiple are configured?
Show Answer
**Answer: Kubernetes tries each authentication method in sequence until one succeeds. The first successful authentication is used.**
**Explanation:** Authentication methods are tried in a chain. If all methods fail, the request is rejected with a 401 Unauthorized error.
## Hands-on Questions
### 1. Write a Role and RoleBinding that meets the following requirements:
* Namespace: development
* Permissions: Pod read (get, list, watch), ConfigMap full access
* User:
Show Answer
```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
namespace: development
name: developer-role
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list", "watch"]
- apiGroups: [""]
resources: ["configmaps"]
verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: developer-binding
namespace: development
subjects:
- kind: User
name: developer@example.com
apiGroup: rbac.authorization.k8s.io
roleRef:
kind: Role
name: developer-role
apiGroup: rbac.authorization.k8s.io
```
### 2. Create a ServiceAccount with a custom token expiration time.
Show Answer
```yaml
# ServiceAccount definition
apiVersion: v1
kind: ServiceAccount
metadata:
name: custom-sa
namespace: default
---
# Pod using projected token with custom expiration
apiVersion: v1
kind: Pod
metadata:
name: app-with-custom-token
spec:
serviceAccountName: custom-sa
containers:
- name: app
image: nginx
volumeMounts:
- name: token
mountPath: /var/run/secrets/tokens
volumes:
- name: token
projected:
sources:
- serviceAccountToken:
path: token
expirationSeconds: 3600 # 1 hour
audience: api
```
**Explanation:** Using projected volumes with `serviceAccountToken`, you can specify custom `expirationSeconds` (minimum 600 seconds) and `audience` for the token.
### 3. Write a command to check what permissions a specific user has.
Show Answer
```bash
# Check if a user can perform a specific action
kubectl auth can-i create deployments --as=developer@example.com -n development
# List all permissions for a user in a namespace
kubectl auth can-i --list --as=developer@example.com -n development
# Check permissions for a ServiceAccount
kubectl auth can-i --list --as=system:serviceaccount:default:my-sa
# Impersonate a group
kubectl auth can-i create pods --as=developer@example.com --as-group=developers -n development
```
**Explanation:** The `kubectl auth can-i` command allows checking permissions for the current user or impersonating other users/groups to verify their access levels.
## Advanced Questions
### 1. Design a security strategy for tenant isolation in a multi-tenant Kubernetes cluster.
Show Answer
**Namespace and RBAC Design:**
* Create separate namespaces per tenant
* Apply Pod Security Standards
* Implement NetworkPolicy for network isolation
* Set ResourceQuota for resource limits
```yaml
apiVersion: v1
kind: Namespace
metadata:
name: tenant-alpha
labels:
tenant: alpha
pod-security.kubernetes.io/enforce: restricted
---
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: default-deny-all
namespace: tenant-alpha
spec:
podSelector: {}
policyTypes:
- Ingress
- Egress
---
apiVersion: v1
kind: ResourceQuota
metadata:
name: tenant-quota
namespace: tenant-alpha
spec:
hard:
requests.cpu: "10"
requests.memory: 20Gi
limits.cpu: "20"
limits.memory: 40Gi
pods: "50"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: tenant-admin
namespace: tenant-alpha
rules:
- apiGroups: ["", "apps", "batch"]
resources: ["*"]
verbs: ["*"]
- apiGroups: ["networking.k8s.io"]
resources: ["networkpolicies"]
verbs: ["get", "list"] # Read-only for network policies
```
**Additional Security Measures:**
* Use separate ServiceAccounts per application
* Implement audit logging
* Use admission webhooks for policy enforcement
* Consider using Hierarchical Namespaces for sub-tenant management
### 2. Explain the complete authentication and authorization flow when a kubectl command is executed.
Show Answer
**Complete Flow:**
1. **Client Authentication (kubeconfig)**
* kubectl reads `~/.kube/config`
* Extracts credentials (certificate, token, or exec plugin)
* For EKS: `aws eks get-token` generates temporary token
2. **API Server Authentication**
* API server receives request with credentials
* Tries authentication methods in order:
* X.509 client certificates
* Bearer tokens (ServiceAccount, OIDC)
* Authentication proxy
* Webhook token authentication
* First successful method determines identity
3. **Authorization**
* API server checks authorization (typically RBAC)
* Evaluates all applicable Roles/ClusterRoles
* Decision: Allow or Deny
* If multiple authorizers: first non-deny wins
4. **Admission Control**
* **Mutating Admission**: modifies the request
* Adds defaults, injects sidecars
* **Validating Admission**: validates the request
* Enforces policies, quotas
* Both can reject the request
5. **Persistence**
* If all checks pass, resource is stored in etcd
* Response returned to client
```
kubectl -> kubeconfig -> API Server
|
Authentication
|
Authorization (RBAC)
|
Mutating Admission
|
Validating Admission
|
etcd
```
**Key Points:**
* Authentication determines WHO you are
* Authorization determines WHAT you can do
* Admission controls HOW resources are modified/validated