Exam
CKS
Home › CKS › Topics › Practice tasks › Secure the API Server (Anonymous Auth, Node,RBAC, NodeRestriction)
CKS · Cluster Setup
Secure the API Server (Anonymous Auth, Node,RBAC, NodeRestriction)
First, secure the cluster's API server configuring it as follows: Forbid anonymous authentication Use authorization mode Node,RBAC Use admission controller NodeRestriction The cluster uses the Docker…
Live lab access
This task description is public. Live practice requires full access unless this is the selected free weekly task. See this week's free task.
Create an account to continue →
On a phone? Read the task and create your account here, then sign in on a desktop or laptop for the terminal lab. Nothing starts until you choose Start.
The task
Context
For testing purposes, the kubeadm provisioned cluster's API server was configured to allow unauthenticated and unauthorized access.
Task
First, secure the cluster's API server configuring it as follows:
- Forbid anonymous authentication
- Use authorization mode
Node,RBAC - Use admission controller
NodeRestriction
The cluster uses the Docker Engine as its container runtime. If needed, use the docker command to troubleshoot running containers.
kubectl is configured to use unauthenticated and unauthorized access. You do not have to change it but be aware that kubectl will stop working once you have secured the cluster.
> You can use the cluster's original kubectl configuration file located at /etc/kubernetes/admin.conf to access the secured cluster.
Next, to clean up, remove the ClusterRoleBinding system:anonymous.
*Lab note: this practice node runs containerd rather than the Docker Engine, so use crictl (or kubectl) where you would use docker.*
What this tests
Lock down network access, the kubelet, API authentication, and ingress TLS, and run CIS benchmark checks. On the CKS exam, Cluster Setup tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.
Practice it for real
The public description lets you study the task before signing up. Full access includes this live lab; the selected Task of the Week is free with an account. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). You can open the solution while practising, then retry and use the failed checks to improve your score.