Skip to content

API Server: KCSA practice questions

The kube-apiserver is the single entry point to the cluster. kubectl, controllers, the scheduler and every kubelet send their requests to it, and it validates objects and writes them to the backing store. Securing the cluster largely means controlling what reaches the API server and what it allows.

By Ibrahim Yesilay · Published · Updated

Independent community practice, not affiliated with or endorsed by CNCF or The Linux Foundation.

What API Server covers in KCSA

The kube-apiserver is the single entry point to the cluster. kubectl, controllers, the scheduler and every kubelet send their requests to it, and it validates objects and writes them to the backing store. Securing the cluster largely means controlling what reaches the API server and what it allows.

Each request passes through a fixed sequence. Transport security comes first: by default the API server listens on port 6443 with TLS, and the secure port cannot be switched off. Authentication follows; several authenticators can be configured and are tried in turn until one succeeds, and a request that cannot be authenticated is rejected with HTTP 401. Authorization comes next; if any configured module allows the request it proceeds, and if all deny it the result is HTTP 403. Admission control is last and runs only for requests that create, modify, delete or connect to an object: mutating admission controllers run first, validating ones second, and a rejection from any of them fails the whole request. Only then is the object validated and persisted. Auditing records the sequence of actions as a chronological, security-relevant log.

Several flags carry security weight. --anonymous-auth defaults to true, which means a request not rejected by another authenticator is treated as user system:anonymous in group system:unauthenticated; setting it to false makes such requests fail authentication. --authorization-mode takes a comma-separated list from AlwaysAllow, AlwaysDeny, ABAC, Webhook, RBAC and Node, and defaults to AlwaysAllow when no authorization configuration file is used, so clusters set modes such as Node and RBAC explicitly. --enable-admission-plugins adds plugins to the default set, and plugin order in that flag does not matter. --audit-policy-file and --audit-log-path turn on audit logging. --encryption-provider-config points to the configuration that encrypts Secrets stored in etcd, so encryption at rest is an API server setting. --profiling defaults to true and exposes /debug/pprof.

Service account tokens involve two halves. --service-account-signing-key-file holds the private key the token issuer signs tokens with, and --service-account-key-file holds the keys used to verify ServiceAccount tokens; it must be set when the signing key is set.

Some admission plugins come up repeatedly. NodeRestriction limits a kubelet, identified as system:node:<nodeName> in group system:nodes, to modifying its own Node object and Pods bound to its node. ImagePolicyWebhook is disabled by default; it is enabled through --enable-admission-plugins and configured through --admission-control-config-file, where the defaultAllow setting decides what happens if the webhook backend fails.

API Priority and Fairness protects the server from overload. It is enabled by default, classifies requests with FlowSchema objects and assigns them to priority levels that each have their own concurrency limit, so one class of traffic cannot starve another. On kubeadm clusters the server runs as a static Pod defined in /etc/kubernetes/manifests/kube-apiserver.yaml, which is the first file to check when it does not come up.

Key points

  • Request order: TLS, authentication (401 on failure), authorization (403 on failure), mutating admission, validating admission, persistence.
  • --anonymous-auth defaults to true; anonymous requests map to system:anonymous and system:unauthenticated.
  • --authorization-mode defaults to AlwaysAllow unless an authorization configuration file is used.
  • Encryption of Secrets at rest is configured on the API server with --encryption-provider-config.
  • FlowSchema and PriorityLevelConfiguration objects implement API Priority and Fairness.

Three sample questions

19 KCSA questions on API Server, 19 with explanations. How practice works

Question 1

Which Kubernetes admission controller runs first during the admission control process?
  1. A.ValidatingAdmissionWebhook
  2. B.MutatingAdmissionWebhook
  3. C.ResourceQuota
  4. D.NamespaceLifecycle
  5. E.AlwaysPullImages

Correct answer: B

The MutatingAdmissionWebhook runs first in the Kubernetes admission control process. This is because mutating admission controllers are designed to modify the incoming request before it is validated by validating admission controllers. Other options, such as ValidatingAdmissionWebhook, ResourceQuota, NamespaceLifecycle, and AlwaysPullImages, either run later in the process or serve different purposes.

Sources: Kubernetes Official Documentation - Admission Controllers, Styra Blog - What Is Kubernetes Admission Control?

Question 2

When you run the command 'kubectl apply', which Kubernetes component processes the request first?
  1. A.etcd
  2. B.kube-scheduler
  3. C.kube-controller-manager
  4. D.kube-apiserver
  5. E.kubelet

Correct answer: D

All kubectl commands interact first with the kube-apiserver, which is the central management entity of the Kubernetes control plane. The API server authenticates and validates the request, then persists the desired state in etcd. Other components like the scheduler and controller manager act later based on the updated state.

Sources: Kubernetes Official Documentation - kubectl Overview, Kubernetes Architecture - Control Plane Components

Question 3

What does the '--anonymous-auth=false' flag do when set on the kube-apiserver?
  1. A.Disables anonymous requests to the API server
  2. B.Disables authentication entirely
  3. C.Allows all requests without authentication
  4. D.Enables anonymous authentication
  5. E.Forces all clients to use tokens

Correct answer: A

Setting '--anonymous-auth=false' on the kube-apiserver ensures that all requests to the API server must be authenticated. This enhances security by preventing unauthorized access.

Sources: Kubernetes API Server Documentation, Kubernetes Security Configuration

Practice this topic

Focus mode keeps every question on API Server until you leave it. 10 free guest answers, then a free account; no credit card.

Or open KCSA practice across all topics.

Sources

The explanation above was checked against these official documents.