Reconfigure the cluster's Kubernetes API server to ensure that only authenticated and authorized REST requests are allowed. Use authorization mode Node,RBAC and admission controller NodeRestriction. C

Question

Explanation

This task tests the ability to harden a Kubernetes API server that was deliberately misconfigured to allow unauthenticated/unauthorized access, by restoring proper authorization modes, admission controllers, and removing a dangerous ClusterRoleBinding.

Approach. Switch to the correct context with kubectl config use-context KSCH00101, then SSH into the master node and edit the static pod manifest at /etc/kubernetes/manifests/kube-apiserver.yaml. In that file, set --authorization-mode=Node,RBAC, ensure --enable-admission-plugins=NodeRestriction is present (or added), and remove or set --anonymous-auth=false if it was explicitly enabled. After saving, kubelet will automatically restart the API server pod. Finally, from a kubectl-accessible context, identify and delete the offending ClusterRoleBinding with kubectl get clusterrolebinding | grep anonymous followed by kubectl delete clusterrolebinding <name> - this removes the cluster-admin privilege granted to system:anonymous.

Concept tested. Kubernetes API server security hardening - specifically: (1) controlling authentication via --anonymous-auth, (2) enforcing least-privilege authorization using Node+RBAC modes, (3) restricting kubelet API access via the NodeRestriction admission controller, and (4) auditing and removing overly permissive ClusterRoleBindings that expose cluster-admin to unauthenticated users.

Reference. https://kubernetes.io/docs/reference/access-authn-authz/rbac/ | https://kubernetes.io/docs/reference/access-authn-authz/node/ | https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction

No community discussion yet for this question.