Multi-team platform, mission 2 of 5
A key for the robot
intermediate, about 10 minutes, in the Kubernetes Simulator
Start mission
Opens once you pass A room each.
The briefing
The checkout team's CI pipeline deploys by running kubectl. Right now it borrows an admin's credentials — which could read the payment keys and wreck the search team's namespace.
Give it its own identity: a ServiceAccount, ci, in checkout. On its own it may do nothing. A Role lists what may be done (verbs on resources) in one namespace; a RoleBinding grants a Role to a subject. kubectl auth can-i VERB RESOURCE --as=system:serviceaccount:checkout:ci -n NS asks the API server as the robot.
What you'll do
- CI can create, update and patch deployments in checkout
- …but can't read secrets, or touch search
- Check its rights with kubectl auth can-i --as
- Bonus star: Watch the robot get turned away from the payment keys
The mission checks the cluster, not your keystrokes: any fix that works, passes.
Read first
More Multi-team platform missions
- 1. A room each
- 2. A key for the robot
- 3. Look, don't touch
- 4. Fair share
- 5. No room to roll