Service accounts in Kubernetes - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to create a service account named 'my-service' in Kubernetes.

Kubernetes

kubectl create serviceaccount [1]

Drag options to blanks, or click blank then click option'

Amy-service

Bdefault

Cadmin

Dkube-system

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'default' which is the default service account, not creating a new one.

Using namespace names like 'kube-system' instead of a service account name.

The command kubectl create serviceaccount my-service creates a new service account named 'my-service'.

2fill in blank

medium

Complete the command to list all service accounts in the 'dev' namespace.

Kubernetes

kubectl get serviceaccounts -n [1]

Drag options to blanks, or click blank then click option'

Adefault

Bprod

Ckube-system

Ddev

Attempts:

3 left

💡 Hint

Common Mistakes

Using the default namespace instead of 'dev'.

Confusing namespaces like 'prod' or 'kube-system'.

The -n dev flag specifies the 'dev' namespace to list service accounts there.

3fill in blank

hard

Fix the error in the command to delete the service account named 'test-account' in the 'test' namespace.

Kubernetes

kubectl delete serviceaccount [1] -n test

Drag options to blanks, or click blank then click option'

Atest-account-1

Btest_account

Ctest-account

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using underscores instead of dashes.

Using a different service account name.

The service account name must exactly match 'test-account' to delete it correctly.

4fill in blank

hard

Fill both blanks to create a service account named 'build-bot' in the 'ci' namespace and then get its details.

Kubernetes

kubectl create serviceaccount [1] -n [2]
kubectl get serviceaccount [1] -n [2] -o yaml

Drag options to blanks, or click blank then click option'

Abuild-bot

Bci

Cdefault

Dprod

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing namespaces between commands.

Using wrong service account names.

Use 'build-bot' as the service account name and 'ci' as the namespace in both commands.

5fill in blank

hard

Fill all three blanks to create a service account 'deploy-sa' in namespace 'staging', patch it to add an image pull secret 'reg-secret', and then describe it.

Kubernetes

kubectl create serviceaccount [1] -n [2]
kubectl patch serviceaccount [1] -n [2] -p '{"imagePullSecrets": [{"name": "[3]"}]}'
kubectl describe serviceaccount [1] -n [2]

Drag options to blanks, or click blank then click option'

Adeploy-sa

Bstaging

Creg-secret

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong secret names or namespaces.

Forgetting to patch the service account before describing.

Use 'deploy-sa' as the service account name, 'staging' as the namespace, and 'reg-secret' as the image pull secret name.

Practice

1. What is the main purpose of a ServiceAccount in Kubernetes?

easy

A. To schedule pods on specific nodes

B. To give a pod an identity and control its permissions inside the cluster

C. To manage network policies between pods

D. To store container images for pods

Solution

1. Step 1: Understand what identity means in Kubernetes

   A ServiceAccount provides an identity for pods so they can authenticate to the Kubernetes API.

2. Step 2: Recognize the role of permissions

   ServiceAccounts are linked to permissions (via Roles or ClusterRoles) to control what pods can do.

3. Final Answer:

   To give a pod an identity and control its permissions inside the cluster -> Option B

4. Quick Check:

   ServiceAccount = Pod identity and permissions [OK]

Hint: ServiceAccount = pod identity + permissions [OK]

Common Mistakes:

• Confusing ServiceAccount with image storage
• Thinking ServiceAccount manages pod scheduling
• Mixing ServiceAccount with network policies

2. Which of the following is the correct YAML snippet to create a ServiceAccount named my-service-account?

easy

A. apiVersion: apps/v1
kind: Deployment
metadata:
name: my-service-account

B. apiVersion: v1
kind: Pod
metadata:
name: my-service-account

C. apiVersion: v1
kind: ServiceAccount
metadata:
name: my-service-account

D. apiVersion: v1
kind: Namespace
metadata:
name: my-service-account

Solution

1. Step 1: Identify the correct kind for ServiceAccount

   The kind must be ServiceAccount to create a service account resource.

2. Step 2: Check the apiVersion and metadata

   ServiceAccount uses apiVersion: v1 and metadata with the name field.

3. Final Answer:

   apiVersion: v1 kind: ServiceAccount metadata: name: my-service-account -> Option C

4. Quick Check:

   ServiceAccount YAML uses kind: ServiceAccount [OK]

Hint: ServiceAccount YAML always uses kind: ServiceAccount [OK]

Common Mistakes:

• Using wrong kind like Pod or Deployment
• Wrong apiVersion for ServiceAccount
• Confusing Namespace with ServiceAccount

3. Given this command: kubectl get serviceaccount default -o jsonpath='{.secrets[0].name}', what does it output?

medium

A. The name of the first secret linked to the default ServiceAccount

B. The list of all pods using the default ServiceAccount

C. The token value inside the secret

D. An error because jsonpath is invalid

Solution

1. Step 1: Understand the command structure

   The command fetches the ServiceAccount named 'default' and extracts the first secret's name using jsonpath.

2. Step 2: Interpret the jsonpath expression

   The expression {.secrets[0].name} selects the name of the first secret linked to the ServiceAccount.

3. Final Answer:

   The name of the first secret linked to the default ServiceAccount -> Option A

4. Quick Check:

   jsonpath extracts secret name from ServiceAccount [OK]

Hint: jsonpath {.secrets[0].name} gets first secret name [OK]

Common Mistakes:

• Thinking it lists pods instead of secrets
• Expecting secret token value instead of secret name
• Assuming jsonpath syntax is wrong

4. You created a ServiceAccount but your pod fails to use it. Which of these is the most likely cause?

medium

A. The ServiceAccount was created in a different namespace

B. The pod image is missing

C. The ServiceAccount has no secrets linked

D. The pod spec does not specify the ServiceAccount name

Solution

1. Step 1: Check namespace consistency

   ServiceAccounts are namespace-scoped. If the pod is in one namespace but the ServiceAccount in another, the pod cannot use it.

2. Step 2: Verify pod spec and ServiceAccount existence

   Even if the ServiceAccount exists in the same namespace, the pod must specify the ServiceAccount name in its spec to use it.

3. Final Answer:

   The pod spec does not specify the ServiceAccount name -> Option D

4. Quick Check:

   Pod spec must specify serviceAccountName to use it [OK]

Hint: Pod spec must specify serviceAccountName [OK]

Common Mistakes:

• Forgetting to specify serviceAccountName in pod spec
• Assuming missing secrets cause pod failure
• Blaming pod image unrelated to ServiceAccount

5. You want a pod to use a custom ServiceAccount named app-sa and access the Kubernetes API with limited permissions. Which steps should you follow?

hard

A. Create the ServiceAccount app-sa, create a Role with permissions, bind the Role to app-sa, then specify serviceAccountName: app-sa in the pod spec

B. Create a RoleBinding for the default ServiceAccount, then deploy the pod without specifying serviceAccountName

C. Create a ClusterRole with full permissions and assign it to the pod directly

D. Deploy the pod first, then create the ServiceAccount and Role

Solution

1. Step 1: Create the custom ServiceAccount

   Define and create app-sa in the pod's namespace to give the pod an identity.

2. Step 2: Define permissions and bind them

   Create a Role with limited permissions and bind it to app-sa using a RoleBinding.

3. Step 3: Specify the ServiceAccount in the pod spec

   Set serviceAccountName: app-sa in the pod spec so the pod uses this identity and permissions.

4. Final Answer:

   Create the ServiceAccount app-sa, create a Role with permissions, bind the Role to app-sa, then specify serviceAccountName: app-sa in the pod spec -> Option A

5. Quick Check:

   Custom ServiceAccount + Role + RoleBinding + pod spec = correct setup [OK]

Hint: Create SA, Role, RoleBinding, then assign SA to pod [OK]

Common Mistakes:

• Assigning permissions to default ServiceAccount instead of custom
• Creating ClusterRole with too many permissions
• Deploying pod before creating ServiceAccount and Role