---
# System prepended metadata

title: 第九题 RBAC & ServiceAccount
tags: [真题讲解]

---

# 第九题 RBAC & ServiceAccount
###### tags: `真题讲解`
切换集群kubectl config use-context k8s
**Context**
A Pod fails to run because of an incorrectly specified ServiceAcccount.

**Task**
create a new ServiceAccount named **frontend-sa** in the existing namespace qa, which must not have access to **any secrets**. Inspect the Pod named frontend running inthe namespace qa.

Edit the Pod to use the newly created serviceAccount **frontend-sa**.

You can find the Pod's manifest file at/cks/9/pod9.yaml Ensure that the modified specification is applied and the Pod is running.

Finally, clean-up and delete the now unused serviceAccount that the Pod used initially.

## 解法
```
kubectl create sa frontend-sa -n qa
```

```
kubectl create clusterrolebinding crb:view:qa:frontend-sa --clusterrole view --serviceaccount qa:frontend-sa
```
校验该SA的权限
```
kubectl auth can-i --as system:serviceaccount:qa:frontend-sa get pod -n qa                                                                              
yes

kubectl auth can-i --as system:serviceaccount:qa:frontend-sa get secret -n qa
no

kubectl auth can-i --as system:serviceaccount:qa:frontend-sa get secret      
no
```

再给定的YAML中替换Pod的ServiceAccount, 重启部署Pod.
**切记: 删除原SA**