Kubernetes and Cloud Native Security Associate (KCSA) free question 8 / 10 · Domain 5: Platform Security
A monitoring ServiceAccount is refused when it scrapes the /metrics endpoint of control plane components in a cluster that uses RBAC. What does "Metrics For Kubernetes System Components" say is needed?
- Only alpha metrics need authorization, so the scraper should read only stable metrics.
- Nothing in RBAC, because /metrics is a public endpoint that no authorizer evaluates.
- Authorization for the identity through a ClusterRole that allows access to /metrics.
- The show-hidden-metrics-for-version flag, set to the version that the scraper runs.
Show the answer and explanation
Answer: C
Why this is correct
The page states: "In most cases metrics are available on /metrics endpoint of the HTTP server." It lists kube-controller-manager, kube-proxy, kube-apiserver, kube-scheduler and the kubelet as examples. Access is controlled: "If your cluster uses RBAC, reading metrics requires authorization via a user, group or ServiceAccount with a ClusterRole that allows accessing /metrics." The example on the page is a ClusterRole whose rule lists nonResourceURLs with "/metrics" and the verb get; it is bound to the monitoring identity. The page also suggests that in production you may "configure Prometheus Server or some other metrics scraper to periodically gather these metrics" into a time series database. Requiring authorization matters for security, because metrics describe the inner state of components, and only the monitoring identities that need them should be able to read them.
Why the other options are wrong
"Only alpha metrics need authorization, so the scraper should read only stable metrics." … Stability levels are about change, not access: "Alpha metrics have no stability guarantees", while "Stable metrics are guaranteed to not change." The RBAC rule applies to reading metrics at all.
"The show-hidden-metrics-for-version flag, set to the version that the scraper runs." … That flag is "an escape hatch for admins if they missed the migration of the metrics deprecated in the last release", and it "can only take the previous minor version as its value."
"Nothing in RBAC, because /metrics is a public endpoint that no authorizer evaluates." … The page says the opposite: "If your cluster uses RBAC, reading metrics requires authorization".
Reading metrics is an authorized action
Component metrics are served on /metrics. With RBAC, the scraper's user, group or ServiceAccount needs a ClusterRole that allows access to /metrics.