ssh ckad00043
You have two deliverables here:
Figure out what RBAC permissions the scraper Deployment needs (the logs will usually show “Forbidden” with the missing verb/resource).
Create a ServiceAccount named scraper in namespace cute-panda (and in practice, you then bind the needed permissions to it and use it in the Deployment so it actually works).
Below is the exact CKAD-style workflow.
1) Find the missing RBAC permissions (use logs + events)
1.1 Identify the pods for the Deployment
kubectl -n cute-panda get deploy scraper
kubectl -n cute-panda get pods -l app=scraper 2>/dev/null || kubectl -n cute-panda get pods
Pick one pod name and check logs:
kubectl -n cute-panda logs deploy/scraper --tail=100
If the pod is crashlooping and logs are short:
POD=$(kubectl -n cute-panda get pods -o jsonpath='{.items[0].metadata.name}')
kubectl -n cute-panda logs "$POD" --previous --tail=200
1.2 Look specifically for “Forbidden” lines
Most apps print errors like:
... is forbidden: User "system:serviceaccount:cute-panda:default" cannot list resource "pods" in API group "" in the namespace "cute-panda"
or cannot get resource "configmaps"...
or cannot watch ...
If you don’t see it in logs, check events:
kubectl -n cute-panda get events --sort-by=.lastTimestamp | tail -n 30
1.3 Extract verb/resource/apiGroup from the error
From a typical Kubernetes RBAC “forbidden” message, capture:
verb: get/list/watch/create/update/patch/delete
resource: pods, configmaps, secrets, deployments, etc.
apiGroup: "" (core), apps, batch, etc.
namespace: cute-panda (this is a namespaced permission if it’s a Role)
You may have multiple “cannot …” lines → you need to allow all of them.
2) Create the ServiceAccount scraper (required by the task)
kubectl -n cute-panda create serviceaccount scraper
kubectl -n cute-panda get sa scraper
3) Create the RBAC objects to grant the needed permissions
The task says “A Deployment needs specific RBAC permissions” — in CKAD, that usually means: Role + RoleBinding (namespaced) bound to your new ServiceAccount.
3.1 Create a Role (template you fill from the log output)
Create scraper-role.yaml:
cat <<'EOF' > scraper-role.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: scraper-role
namespace: cute-panda
rules:
# EXAMPLE ONLY: replace these rules with what your logs show
- apiGroups: [""]
resources: ["pods"]
verbs: ["get","list","watch"]
EOF
Apply it:
kubectl apply -f scraper-role.yaml
3.2 Bind the Role to the ServiceAccount
kubectl -n cute-panda create rolebinding scraper-rb \
--role=scraper-role \
--serviceaccount=cute-panda:scraper
Verify:
kubectl -n cute-panda get role scraper-role
kubectl -n cute-panda get rolebinding scraper-rb -o yaml
4) Update the Deployment to use the new ServiceAccount (so it actually works)
Check current SA (likely default):
kubectl -n cute-panda get deploy scraper -o jsonpath='{.spec.template.spec.serviceAccountName}{"\n"}'
Patch it to use scraper:
kubectl -n cute-panda patch deploy scraper -p '{"spec":{"template":{"spec":{"serviceAccountName":"scraper"}}}}'
Rollout:
kubectl -n cute-panda rollout status deploy scraper
Re-check logs to confirm RBAC errors are gone:
kubectl -n cute-panda logs deploy/scraper --tail=100
