What Kubernetes feature defines privilege and access control settings for a Pod or Container?

What Kubernetes feature defines privilege and access control settings for a Pod or Container?

• A. Namespaces
• B. Security Contexts
• C. Pod Templates
• D. Service Accounts

Answer: (B)

Security contexts are the mechanism used to define privilege and access control for containers running in a Pod. They let you specify what user and group the container processes run as, which Linux capabilities are added or dropped (for example, NET_ADMIN or SYS_TIME), whether the root filesystem is read-only, and other security-related settings like SELinux, AppArmor, or seccomp profiles. You can apply these settings at the container level or at the Pod level (PodSecurityContext), governing what the container is allowed to do on the host and within the Pod. Namespaces organize and isolate resources at a cluster level, not control the runtime privileges inside containers. Pod Templates describe the desired Pod configuration but don’t enforce per-container privilege rules. Service Accounts provide an identity for Pods to access the Kubernetes API, not the container’s internal privilege scope.

Security contexts are the mechanism used to define privilege and access control for containers running in a Pod. They let you specify what user and group the container processes run as, which Linux capabilities are added or dropped (for example, NET_ADMIN or SYS_TIME), whether the root filesystem is read-only, and other security-related settings like SELinux, AppArmor, or seccomp profiles. You can apply these settings at the container level or at the Pod level (PodSecurityContext), governing what the container is allowed to do on the host and within the Pod.

Namespaces organize and isolate resources at a cluster level, not control the runtime privileges inside containers. Pod Templates describe the desired Pod configuration but don’t enforce per-container privilege rules. Service Accounts provide an identity for Pods to access the Kubernetes API, not the container’s internal privilege scope.