easyMultiple ChoiceObjective-mapped
CKS Practice Question: Which admission plugin should be enabled to…
Which admission plugin should be enabled to prevent kubelets from modifying nodes or pods they do not own?
⚠ Common exam trap
CNCF often tests the NodeRestriction plugin by pairing it with other admission controllers like AlwaysPullImages or PodSecurity, leading candidates to confuse security-focused plugins with node-level access control.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NodeRestriction
The NodeRestriction admission plugin ensures that kubelets can only modify the Node and Pod objects they are assigned to. It enforces that a kubelet with a specific node identity can only label, taint, or update its own Node object and can only create/modify Pods that are bound to that node. This prevents a compromised or misconfigured kubelet from tampering with other nodes or pods in the cluster.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AlwaysPullImages
Why it's wrong here
AlwaysPullImages forces every pod to re-pull its container image from the registry on each start, but it has no mechanism to authorise or deny a kubelet’s attempt to modify a node or pod object via the Kubernetes API. It is tempting because it enforces a security posture around image freshness and prevents stale or cached images from being used, which could be a correct choice in a scenario where the goal is to ensure that only the latest image version runs, not to enforce node-ownership boundaries.
- ✗
PodSecurity
Why it's wrong here
PodSecurity validates pod-level security contexts via Pod Security Standards but does not restrict kubelet modifications to nodes or pods. The correct plugin, NodeRestriction, limits kubelet write operations to its own node and pods scheduled there. PodSecurity is tempting because it enforces pod security policies, yet it addresses workload hardening, not kubelet authorisation — it would be correct for preventing privileged containers, not node/pod ownership violations.
- ✓
NodeRestriction
Why this is correct
NodeRestriction is an admission plugin that enforces node-ownership boundaries on API writes by kubelets. It limits each kubelet to updating only its own Node object and only Pod objects that have `spec.nodeName` set to that node, effectively preventing a compromised kubelet from modifying other nodes or pods. It also blocks kubelets from adding or removing Node labels with restricted prefixes and denies attempts to create objects outside those allowed references. In combination with the Node authorizer, this plugin provides a critical least-privilege control for the Kubernetes data plane.
- ✗
ServiceAccount
Why it's wrong here
The ServiceAccount admission plugin is responsible for mutating Pod objects to set a default service account when none is provided and for mounting projected service account tokens into containers. It has no mechanism to inspect or restrict the privileges of requests coming from the kubelet process itself, because kubelets authenticate as system:nodes and are governed by the Node authorizer. Enabling ServiceAccount therefore does nothing to limit what a kubelet can modify on the API; it is purely a pod-identity and token-management feature that might be tempting to select out of a general intent to harden authentication, but it does not address node/pod ownership violations.
Go deeper
Related to this question
About these practice questions
One of 114 original CKS practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.