Safe
kubectl auth can-i --list --as=system:serviceaccount:default:defaultcross-platform · yaml · Nightmare
Asks the API server what a given service account is permitted to do. The --as flag looks like impersonation, but this subcommand only evaluates policy and returns a table; you must already hold impersonation rights for it to answer at all.
Think you can spot these under time pressure?
Start TrainingMore Kubernetes
kubectl get pods -n defaultIntermediatekubectl delete namespace productionIntermediatekubectl describe pod web-0Advancedkubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -dExpertkubectl create clusterrolebinding sa-admin --clusterrole=cluster-admin --serviceaccount=default:defaultExpertkubectl get pods -A -o jsonpath='{range .items[*]}{.metadata.namespace}{"\t"}{.spec.containers[*].image}{"\n"}{end}' | sort | uniq -c | sort -rnNightmare