Roles and ClusterRoles in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Role that allows reading pods in a namespace.

Kubernetes

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["[1]"]

Drag options to blanks, or click blank then click option'

Adelete

Bcreate

Cupdate

Dget

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'create' instead of 'get' will allow creating pods, not reading.

The verb get allows reading pod details in the namespace.

2fill in blank

medium

Complete the code to create a ClusterRole that allows listing all nodes.

Kubernetes

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: node-lister
rules:
- apiGroups: [""]
  resources: ["[1]"]
  verbs: ["list"]

Drag options to blanks, or click blank then click option'

Aservices

Bnodes

Cpods

Ddeployments

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing 'pods' will limit the role to pods, not nodes.

The resource nodes represents all nodes in the cluster, which ClusterRole can list.

3fill in blank

hard

Fix the error in the Role binding to bind the Role 'pod-reader' to user 'alice'.

Kubernetes

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: read-pods-binding
  namespace: default
subjects:
- kind: User
  name: alice
roleRef:
  kind: [1]
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

Drag options to blanks, or click blank then click option'

AClusterRole

BUser

CRole

DServiceAccount

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'ClusterRole' will cause the binding to fail if the role is a Role.

The roleRef.kind must match the kind of role being referenced. Here, it is a Role, not a ClusterRole.

4fill in blank

hard

Fill both blanks to create a ClusterRole that allows creating and deleting services.

Kubernetes

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: service-manager
rules:
- apiGroups: [""]
  resources: ["services"]
  verbs: ["[1]", "[2]"]

Drag options to blanks, or click blank then click option'

Acreate

Bget

Cdelete

Dlist

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'get' or 'list' only allows viewing, not creating or deleting.

The verbs create and delete allow managing services by adding and removing them.

5fill in blank

hard

Fill all three blanks to create a Role that allows updating deployments and listing pods in a namespace.

Kubernetes

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: production
  name: deploy-manager
rules:
- apiGroups: ["apps"]
  resources: ["[1]"]
  verbs: ["[2]"]
- apiGroups: [""]
  resources: ["[3]"]
  verbs: ["list"]

Drag options to blanks, or click blank then click option'

Adeployments

Bupdate

Cpods

Dcreate

Attempts:

3 left

💡 Hint

Common Mistakes

Confusing 'create' with 'update' for modifying deployments.

This Role allows updating deployments in the 'apps' API group and listing pods in the core API group.