Q: You run a pod that needs to call the Kubernetes API (e.g., to list other pods). How do you set this up securely?
1. Create a ServiceAccount: kubectl create serviceaccount my-app -n my-namespace
#Kubernetes #RBAC & Security #L2 #Container Orchestration #K8s
🎙️ Candidate Opening & Architectural Context
""In our production Kubernetes clusters running microservices on EKS/AKS, this was a classic operational challenge. When addressing this question, I walk the interviewer through our production incident runbook: isolating the blast radius, checking diagnostic logs and metrics, and applying a safe fix.""
Advertisement
🛠️ Production Runbook & Step-by-Step Resolution
1️⃣
Initial Diagnostics & Root Cause Analysis
The pod will then have a token mounted at /var/run/secrets/kubernetes.io/serviceaccount/token which it can use to authenticate to the API server.
- Create a ServiceAccount:
kubectl create serviceaccount my-app -n my-namespace - Create a Role with only the needed permissions (principle of least privilege):
- Create a RoleBinding linking the ServiceAccount to the Role.
2️⃣
Remediation & Permanent Safeguards
Avoid using the default ServiceAccount — it often has more permissions than needed.
rules:
- apiGroups: [""]
resources: ["pods"]
verbs: ["get", "list"]- Set
serviceAccountName: my-appin the pod spec.
💡 The Senior SRE Gold Nugget (Key Architectural Takeaway)
"Pro-Tip: Create a ServiceAccount: kubectl create serviceaccount my-app -n my-namespace."
⚡ 60-Second Elevator Pitch Talking Points
- Create a ServiceAccount: kubectl create serviceaccount my-app -n my-namespace
- Create a Role with only the needed permissions (principle of least privilege):
- Create a RoleBinding linking the ServiceAccount to the Role.
Advertisement