easyMultiple Choice
CKS Practice Question: Which admission plugin enforces that kubelets…
Which admission plugin enforces that kubelets cannot modify pods they do not own?
⚠ Common exam trap
CNCF often tests the NodeRestriction plugin as a control for kubelet authorization, and the trap here is confusing it with PodSecurity (which handles pod security contexts) or AlwaysPullImages (which handles image pull policy), rather than recognizing that NodeRestriction specifically limits what a kubelet can modify.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NodeRestriction
The NodeRestriction admission plugin ensures that kubelets can only modify Node and Pod objects that are bound to their own node. It enforces that a kubelet cannot update or delete pods it does not own, preventing a compromised or misconfigured kubelet from interfering with workloads on other nodes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PodSecurity
Why it's wrong here
PodSecurity is an admission plugin that evaluates pods against Pod Security Standards (privileged, baseline, restricted) using namespace labels and security context requirements. It blocks or warns on pod creation or update based on capabilities, SELinux, host namespaces, etc., but it never inspects kubelet-to-API server requests. Node-level restrictions are outside its scope, so it cannot prevent a kubelet from modifying cluster objects.
- ✗
AlwaysPullImages
Why it's wrong here
AlwaysPullImages is a mutating admission plugin that forces every pod's imagePullPolicy to Always, ensuring that images are re-pulled each time and not reused from a node cache. It is primarily used in multi-tenant clusters to prevent node image caching from leaking between tenants. This plugin acts solely on pod image fields at submission time; it has no mechanism to filter or restrict kubelet API requests, so it cannot enforce what kubelets may or may not modify.
- ✓
NodeRestriction
Why this is correct
NodeRestriction is the admission plugin that, together with the Node authorizer, restricts kubelets to self-service APIs. It limits a kubelet to modifying only its own Node object and only specific fields such as status, while denying updates to other Nodes or arbitrary metadata like labels. Critically, it also prevents a kubelet from writing to Pod objects that it does not own (i.e., pods without spec.nodeName matching its node), thereby preventing a compromised kubelet from escalating cluster-wide privileges.
- ✗
ServiceAccount
Why it's wrong here
ServiceAccount is an admission plugin that governs default service accounts and binds service account references to pods, ensuring every pod has a service account name and may inject tokens via projected volumes. It also enforces that the default service account exists for each namespace and can mutate pod specs to add automountServiceAccountToken settings. It is entirely concerned with pod identity and API credentials, not with restricting kubelet actions, so it cannot block a kubelet from modifying Node or Pod objects.
Go deeper
Related to this question
About these practice questions
This CKS question is part of Courseiva's 845-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.