Skip to content
CKSCluster HardeningSingle nodeHard

Restrict the API server: authorization and NodeRestriction

Scenario cks-hrd-003 · about 9 minutes · 8 points · 5 grader checks

The API server authorizes every request and lets kubelets edit any node; restore Node,RBAC authorization and the NodeRestriction admission plugin.

  • kube-apiserver
  • authorization
  • admission
  • noderestriction
  • static-pod

What you will practise

  • Edit kube-apiserver flags in the static pod manifest safely
  • Understand the Node authorizer and the NodeRestriction admission plugin
  • Prove the result with impersonation

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-hrd-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

During an incident the kube-apiserver on exam-cp1 was reconfigured to authorize every request, and the NodeRestriction admission plugin was switched off. Restore the API server configuration (static pod manifest /etc/kubernetes/manifests/kube-apiserver.yaml): - authorization modes Node and RBAC, in that order, and nothing else; - the admission plugin NodeRestriction enabled. The API server must be healthy afterwards. Afterwards an authenticated user without RBAC permissions must not be able to read Secrets, and a kubelet identity must not be able to modify another node's Node object. Do not rebuild the cluster.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Cluster Hardening
Difficulty
Hard
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
9 minutes
Points
8
Grader checks
5
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 5 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Hardening labs

CKSCluster HardeningMedium

RBAC: replace cluster-admin with a namespaced Role

A CI ServiceAccount was given cluster-wide power; remove the bindings and grant a minimal namespaced Role instead.

Single node · ~8 min · 9 points

  • rbac
  • least-privilege
  • serviceaccount
  • clusterrolebinding
  • cluster-hardening

goldenkube start cks-hrd-001

CKSCluster HardeningEasy

ServiceAccounts: stop mounting unused API tokens

Disable token automounting on the default and a dedicated ServiceAccount and move a running Deployment onto it.

Single node · ~7 min · 8 points

  • serviceaccount
  • automount
  • token
  • deployment
  • cluster-hardening

goldenkube start cks-hrd-002

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.