A Role for Rolling Out Apps

medium 20 XP ~8 minHands-on lab

The CI pipeline for reports will deploy with the ServiceAccount release-bot. Security wants it to do exactly its job.

Task

Create the ServiceAccount release-bot in reports.
It can create, update and patch Deployments, StatefulSets and DaemonSets in reports, and get and list them.
It must not be able to delete them, touch any other resource type (including Secrets), or act in any other namespace.
Use a Role and a RoleBinding both named release-bot-workloads.

Start with kubectl create role --help.

About this machine

Ubuntu 24.04 with a private practice cluster: a real Kubernetes API server, scheduler and controllers, and three nodes (controlplane, node01, node02). Containers are simulated, so images never download and kubectl logs/exec are not available. k is an alias for kubectl, with completion. The grader checks the cluster's final state, not the commands you typed.

rbac serviceaccount least-privilege cka