Linux Foundation Kubernetes and Cloud Native KCSA Question # 2 Topic 1 Discussion
KCSA Exam Topic 1 Question 2 Discussion:
Question #: 2
Topic #: 1
Is it possible to restrict permissions so that a controller can only change the image of a deployment (without changing anything else about it, e.g., environment variables, commands, replicas, secrets)?
A.
Yes, by granting permission to the /image subresource.
B.
Not with RBAC, but it is possible with an admission webhook.
C.
No, because granting access to the spec.containers.image field always grants access to the rest of the spec object.
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit