Section 7: Security (20-23)

What are valid authorization mechanisms in a Kubernetes cluster?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

It authorizes any request coming from a user with the name "system:node" and part of the "system:node" group. Then is granted with the privileges.

What type of authorization mechanism is described above?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

When kubelet server access the Kube API to read information about services, nodes, pods, etc...

What type of authorization mechanism is described above?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

It's used when we associate a user or a group of users to a set of permissions. For example, allow a user to view PODs, create PODs or delete PODs.

What type of authorization mechanism is described above?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

We create a policy file in JSON format with a set of policies and pass it to the Kube API configuration.

 

What type of authorization mechanism is described above?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

Instead of associating a user or group of users to a set of permissions, we define a role. The permissions are associated to a role. This role is then applied to users or group of users.

 

What type of authorization mechanism is described above?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

It's externally managed authorization mechanism.

 

What type of authorization mechanism is described above?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

Kubernetes make an API call to the Open Policy Agent with the information about the user and his access requirements. The OPA will decide if the user should be permitted or not.

 

What type of authorization mechanism is described above?

• Webhook

• Node authorizer

• ABAC

• RBAC

• Tokens

What are the two additional authorization modes we can find in Kubernetes cluster?

• AllowAll

• AlwaysAllow

• AlwaysDeny

• DenyAll

"It allows all the request without performing any authorization checks".

What of the additional authorization modes that we can find in Kubernetes cluster does the above statement refer to?

• AllowAll

• AlwaysAllow

• AlwaysDeny

• DenyAll