ServiceAccount, Role, and RoleBinding

In namespace audit, Pod log-collector exists but is failing with authorization errors. Check the Pod logs to identify what permissions are needed: The logs show: User…

Solve this on a real cluster — free → All CKAD tasks

🗓️ Free Task of the Week: one CKAD task is unlocked free for everyone every week — no card, real cluster, auto-graded (2 tries/week). Create a free account and check whether this one is live now.

The task

Task

In namespace audit, Pod log-collector exists but is failing with authorization errors.

Check the Pod logs to identify what permissions are needed:

kubectl logs -n audit log-collector

The logs show: User "system:serviceaccount:audit:default" cannot list pods in the namespace "audit"

Requirements

Create a ServiceAccount named log-sa in namespace audit
Create a Role log-role that grants get, list, and watch on resource pods
Create a RoleBinding log-rb binding log-role to log-sa
Update Pod log-collector to use ServiceAccount log-sa

Exam

CKAD

Domain

Application Environment, Configuration and Security

Grading

Programmatic · partial credit

Reference

Kubernetes docs ↗

What this tests

Wire up configmaps, secrets, service accounts, RBAC, securityContext, and resource limits. On the CKAD exam, Application Environment, Configuration and Security tasks are graded purely on what you build in the cluster — not multiple choice — so the only way to get faster is to do them on a real cluster against a clock.

Practice it for real

prepium.sh drops you into your own isolated Kubernetes cluster in the browser — no install, no credit card. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). The canonical solution unlocks after you attempt it, so you learn the fast, exam-ready way to do it.

Start free → CKAD overview