Study. uk . com
  1. Home
  2. All questions
  3. Question 509

CKA study material · question 509 of 1000

A security review requires that a compromised kubelet cannot relabel other machines in the cluster. Which combination enforces that?

  1. RBAC alone, with a Role granting patch on nodes
  2. Pod Security admission set to restricted in every namespace
  3. The Node authorization mode together with the NodeRestriction admission plugin
  4. An egress NetworkPolicy on the kube-system namespace
Show the answer

Answer: C. The Node authorization mode together with the NodeRestriction admission plugin

With Node authorization and NodeRestriction both enabled, a kubelet may only create or modify the Node object for its own machine. RBAC on its own does not distinguish one kubelet from another.

Source: Nodes (Kubernetes) — Management › Self-registration of Nodes

Challenge yourself on this topic → Study as cards