Service accounts in Kubernetes - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of listing service accounts in a namespace

What is the output of the following command when run in a namespace with two service accounts named default and custom-sa?

Kubernetes

kubectl get serviceaccounts

A

NAME        SECRETS   AGE
custom-sa   1         5d
default     1         10d

B

serviceaccounts/default created
serviceaccounts/custom-sa created

C

NAME        AGE
custom-sa   5d
default     10d

D

NAME        SECRETS
custom-sa   1
default     1

💡 Hint

Use kubectl get serviceaccounts to list all service accounts with their secrets and age.

The kubectl get serviceaccounts command lists all service accounts in the current namespace showing their names, number of secrets, and age.

🧠 Conceptual

intermediate

Purpose of Kubernetes service accounts

Which option best describes the main purpose of a Kubernetes service account?

A To manage network policies between pods in different namespaces.

B To store configuration files for pods to use during startup.

C To provide an identity for processes running in pods to access the Kubernetes API securely.

D To schedule pods onto specific nodes based on resource availability.

💡 Hint

Think about how pods authenticate to the Kubernetes API server.

Service accounts provide an identity for pods so they can securely communicate with the Kubernetes API server.

❓ Configuration

advanced

Correct YAML for creating a service account

Which YAML snippet correctly creates a service account named my-service-account in the production namespace?

A

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: production

B

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  labels:
    namespace: production

C

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
  namespace: prod

D

apiVersion: v1
kind: ServiceAccount
metadata:
  name: my-service-account
namespace: production

💡 Hint

Namespace must be under metadata and spelled exactly as 'production'.

The namespace must be specified under metadata with the exact name. Labels do not set namespace. The field namespace outside metadata is invalid.

❓ Troubleshoot

advanced

Reason for pod failing to access Kubernetes API with service account

A pod using a service account custom-sa cannot access the Kubernetes API and gets a 403 Forbidden error. What is the most likely cause?

A The pod is running in the wrong namespace.

B The pod specification is missing the <code>serviceAccountName</code> field.

C The Kubernetes API server is down.

D The service account <code>custom-sa</code> does not have the necessary Role or ClusterRole bindings.

💡 Hint

Check if the service account has permissions assigned via roles.

A 403 Forbidden error usually means the service account lacks permissions granted by Role or ClusterRole bindings.

🔀 Workflow

expert

Order of steps to create and use a service account in a pod

Arrange the steps in the correct order to create a service account and use it in a pod.

A 1,2,3,4

B 1,3,2,4

C 3,1,2,4

D 2,1,3,4

💡 Hint

Permissions must be granted before the pod uses the service account.

First create the service account, then assign permissions, then reference it in the pod spec, and finally deploy the pod.