Dangerous
kubectl patch daemonset node-agent -n kube-system --type=json -p='[{"op":"add","path":"/spec/template/spec/containers/0/securityContext","value":{"privileged":true}}]'cross-platform · yaml · Nightmare
Adds privileged mode to a daemonset that runs on every node in the cluster. The JSON patch syntax buries the one word that matters, and because it is a daemonset the change propagates to every node at once.
Signals to notice
- privileged: true added to a workload
- DaemonSet applies it to every node
- Intent hidden inside a JSON patch
Think you can spot these under time pressure?
Start TrainingMore Kubernetes
kubectl get pods -n defaultIntermediatekubectl delete namespace productionIntermediatekubectl describe pod web-0Advancedkubectl get secret db-creds -o jsonpath='{.data.password}' | base64 -dExpertkubectl create clusterrolebinding sa-admin --clusterrole=cluster-admin --serviceaccount=default:defaultExpertkubectl auth can-i --list --as=system:serviceaccount:default:defaultNightmare