Kubernetes and Cloud Native Security Associate (KCSA) free question 6 / 10 · Domain 4: Kubernetes Threat Model
A cluster runs public web front ends next to a payment service of a higher sensitivity tier. According to the Pod placement section of the Security Checklist, why should these workloads run on separate nodes?
- To spread the load, so that one busy front end cannot slow down the payment service.
- To keep their logs apart, so that the audit records of the payments stay out of reach.
- So that a breakout from a front-end container gives no direct path to the payments.
- To give each tier its own API server, so that a breakout stays in one control plane.
Show the answer and explanation
Answer: C
Why this is correct
The Pod placement items read: "Pod placement is done in accordance with the tiers of sensitivity of the application" and "Sensitive applications are running isolated on nodes or with specific sandboxed runtimes." The checklist explains that Pods on different tiers of sensitivity, "for example, an application pod and the Kubernetes API server, should be deployed onto separate nodes", and that "The purpose of node isolation is to prevent an application container breakout to directly providing access to applications with higher level of sensitivity to easily pivot within the cluster." It lists features to enforce this so that Pods are not placed together by accident: node selectors (enforced with the PodNodeSelector admission controller), the PodTolerationRestriction admission controller and RuntimeClass. In a threat model, the node is a trust boundary between tiers.
Why the other options are wrong
"To spread the load, so that one busy front end cannot slow down the payment service." … The checklist gives a security reason, not a performance one: stopping a breakout from reaching "applications with higher level of sensitivity". Resource use is handled by the memory and CPU limits in its Pod security section.
"To give each tier its own API server, so that a breakout stays in one control plane." … Separate nodes do not mean separate control planes. The checklist even uses the Kubernetes API server as its example of a Pod on a different sensitivity tier from an application Pod, to be placed on a different node in the same cluster.
"To keep their logs apart, so that the audit records of the payments stay out of reach." … Node separation in this section is about container breakout and pivoting. Protecting audit logs is a separate checklist item under Logs and auditing: "Audit logs, if enabled, are protected from general access."
Tiers of sensitivity map to nodes
Keep workloads of different sensitivity off the same node, so that a container breakout does not land next to something more valuable. Enforce the placement rather than relying on luck.