World map

 

BM

World K6: Guards · Boss challenge

Lock the kitchen

You will learn: to pass the restricted Pod Security level and give a CI bot only the rights it needs.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

Tap each point on the timeline.

Kedai Kancil opens tomorrow. Its zone has no guard. The CI bot holds a master key. Lock the kitchen, room by room.

Try it

Room 1: switch on restricted for kedai. Dry run first, to see what would break.

You are here: cluster kind-dev namespace default
dev-control-planeOpenManager

No trays here.

dev-workerOpen
  • shop·hj28m
dev-worker2Open
  • shop·rklp9
Time: +0s (sped up)

Try it

The warnings named four broken rules. Which lines fix them?

Drag a card into a box. Or tap the card, then tap the box.

      Try it

      Room 2: Mei applied the shop after you locked the zone. Zero trays run. Two fixes wait in your folder. One still breaks a rule. Get two trays running.

      You are here: cluster kind-dev namespace default
      dev-control-planeOpenManager

      No trays here.

      dev-workerOpen

      No trays here.

      dev-worker2Open

      No trays here.

      Time: +0s (sped up)

      Try it

      Room 3: the CI bot holds cluster-admin in kedai. Unplug that wire. Give it only the deployer card.

      Connect wires until every answer matches. Give only what is needed.

      Who (plugs)

      • ci-bot (ServiceAccount · ci)
      • mei (user)

      Roles (sockets)

      • Role deployer · kedai
        • get, list, patch · deployments
      • ClusterRole cluster-admin · whole cluster
        • * · *

      Wires (bindings)

      • ci-botcluster-adminRoleBinding · in namespace kedai
        Show ci-bot-admin as YAML
        apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: ci-bot-admin
  namespace: kedai
subjects:
  - kind: ServiceAccount
    name: ci-bot
    namespace: ci
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin

      Can they? (kubectl auth can-i)

      1. kubectl auth can-i patch deployments -n kedai --as=system:serviceaccount:ci:ci-botyesshould be yes Allowed by ci-bot-admin → cluster-admin.
      2. kubectl auth can-i get secrets -n kedai --as=system:serviceaccount:ci:ci-botyesshould be no Allowed by ci-bot-admin → cluster-admin.
      3. kubectl auth can-i delete deployments -n kedai --as=system:serviceaccount:ci:ci-botyesshould be no Allowed by ci-bot-admin → cluster-admin.
      Ask your own question
      kubectl auth can-i get pods -n kedai --as=system:serviceaccount:ci:ci-botyes

      Try it

      Room 4: now in the terminal. Remove the master key. Apply the job card and pin it. Then ask as the bot.

      You are here: cluster kind-dev namespace default
      Time: +0s (sped up)

      Check

      Last check. The bot’s job now also reads pod logs to report errors. What do you add?

      You did it!

      You can now lock a zone and keep a bot’s keys small.

      Go deeper (optional)

      Real rep (optional): do all four rooms on a throwaway kind cluster. Make the kedai and ci zones first. Dry run every label. Read the pink “you are here” bar before each delete.

      Real mission

      1. kubectl create namespace kedai && kubectl create namespace ci
      2. kubectl label ns kedai pod-security.kubernetes.io/enforce=restricted
      3. kubectl create serviceaccount ci-bot -n ci
      4. kubectl create role deployer -n kedai --verb=get,list,patch --resource=deployments && kubectl create rolebinding ci-bot-deployer -n kedai --role=deployer --serviceaccount=ci:ci-bot
      5. kubectl auth can-i get secrets -n kedai --as=system:serviceaccount:ci:ci-bot

      0 of 5 steps done · Your ticks are saved.