Question 6 on Mock exam number 2

Kubernetes
#1

Hi there, I wonder if anyone has ran into a problem where kubectl is complaining about “error: tls: failed to find any PEM data in certificate input” when I ran the command “kubectl auth can-i delete pods --namespace=development --as=john” to test if the permission has been set properly? I believe it has something to do with my cert file that I created, which is below in a file called john.crt:

-----BEGIN CERTIFICATE-----LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM5VENDQWQyZ0F3SUJBZ0lSQUwrdDB6RDdXZHJiQndNUytSR0ZTWE13RFFZSktvWklodmNOQVFFTEJRQXcKRlRFVE1CRUdBMVVFQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TURFeE1UZ3dNakV4TWpGYUZ3MHlNVEV4TVRndwpNakV4TWpGYU1BOHhEVEFMQmdOVkJBTVRCR3B2YUc0d2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3CmdnRUtBb0lCQVFETGVMeEdFbUtFK01XMjBwVVNmZFdBOU5yUUUxc3kvcS9rWUo5YzVQbzhzdDUxWmtPa29xNXoKTEhZM0w2eGdWQmRkVW8vVWNnV0syTEwxNW9sVDh4M3hrMWQ3QzI3bXZOSmtwajJiSG1PZVAvbDNkOFJXeE1wQwpCbURCNkJRbktiT1l0dDhhTCtGTTdPcFIvVnFndFNVanV4VkZ4Q1hPMnJjQjJQQlp6VzhuSjFoRGd4TE1ZQ3pWClpIb0pHM3lITkd1cTVCOWVObFhBb0xCM0hkZ3JGVzZ3K0NQWVVJUFVBZ0xBNVlBcW4vL3djVFRaa2RTOUREczUKOENFMXNOelY4Y0NmTmxUclc5THBJbjgxUVljOW9QOUdXRG1Pd0ZvMmgwOW0yVVRZQ2dJaG9lNE42OExpWVBiaQpjQks4ZW9RbFlUeHg4VjdkN0VxSHBaUytzbTNpcXhBTEFnTUJBQUdqUmpCRU1CTUdBMVVkSlFRTU1Bb0dDQ3NHCkFRVUZCd01DTUF3R0ExVWRFd0VCL3dRQ01BQXdId1lEVlIwakJCZ3dGb0FVTXlrdVhDYmdPd0U4MEdQVklxVHUKTkZNR1Roc3dEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBSFRQRU9KbXY3Slc2Y2pCdlV4TkMzdzFmSXdVOGJNbwo1SkhQL0NlU2VlcitKTnRNY3lkWkZMMUVidGVETitiTmZweUFUMEREK09ET1pRMnVtQlNQdGpFR0ZCR1ZIak9jCmM2WHVXbmoyVVRSYjI3b2lEeG1TOGQvSUM1a0FkaTcyOWVGQUdEOG52WVFxNFhoem93dGFxR0RBWnVLb1pYVWQKLy9rZkFNRVMzWUJ1OUlkUzJDeXlKZ0FlbmkyMDNWRXRUL0cvRGg4eTlYL0xFRjYxWEErbzdqY3k2aFJaVFpNawpINTJURVpvc0krTmhPWmRNY0s5MWFpY3IzMzZQQkxkUjFVYWg5Vm5GT3k5SnBhN09zeHZ3UnY2M3YyUWpHc2FBCm8vcllkN25KMkRKY0dsMEtZY3lxSVpueGc3L3pnWFY1TWc0V3FRa05OeU9OZm0zWkdycWVFK3c9Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K-----END CERTIFICATE-----

Somehow kubectl is having trouble parsing it. Can someone point me to the right direction please?

#2

Hello, @hellolin324
Can you please tell me what steps did you follow?

#3
  1. First create CSR file with name “john-developer”
  2. Create a CSR file with signerName
  3. Create a role “developer” and to bind with the user “john”, create a rolebinding “john-rolebinding” name could be anything for rolebinding.
  4. Then check for the permission and the easiest way you already knew.
$ kubectl auth can-i get pods -n development --as john
#4

I just tested now and everything is working as expectations. Please try again.
You can find the related content docs in the below links.
RBAC
CSR

#5

solution videos for mock exam 2 seems outdated especially for questions 6 and 7. I did found the right answers/ methods by going through the docs and with help of the some answers here. Hopefully admin will update the solution video for mock exam 2

#6

I agree, seems to be outdated and not detail enough, I hope someone make a formal ticket on this. Not a huge deal but would be nice to make it better, thanks!