Study. uk . com
  1. Home
  2. All questions
  3. Question 595

CKA study material · question 595 of 1000

An operator removes a permission from the system:discovery ClusterRole, and after the next control plane restart the permission is back. What explains this?

  1. An admission webhook restored the role
  2. The API server auto-reconciles default RBAC objects at start-up
  3. The change was written to a stale cached copy
  4. kubeadm reapplies its RBAC manifests on every restart
Show the answer

Answer: B. The API server auto-reconciles default RBAC objects at start-up

Default cluster roles and bindings get missing permissions and subjects restored at every API server start-up, unless the rbac.authorization.kubernetes.io/autoupdate annotation is set to false.

Source: Using RBAC Authorization (Kubernetes) — Default roles and role bindings › Auto-reconciliation

Challenge yourself on this topic → Study as cards