Lesson 0015 · 35 minutes · Cluster Setup and System Hardening

Remove anonymous access to the kubelet

The kubelet is a node-level control point. An exposed read-only or anonymously accessible endpoint can reveal workload and node information, so secure its authentication and authorization before investigating higher-level policy.

Exam reflex: distinguish kubelet authentication from authorization. Disabling anonymous access does not make authorization safe by itself; both controls must be configured.

Timed task: 25 minutes

Review lab/lesson-15-kubelet-config-insecure.yaml. Create a complete replacement configuration as lab/lesson-15-kubelet-config-answer.yaml.

Preserve the API version and kind. Your completed configuration must:

Reject unauthenticated kubelet requests.
Use webhook authentication and webhook authorization for authenticated API requests.
Disable the legacy read-only kubelet port.
Protect kernel defaults.
Enable kubelet client-certificate rotation.

Do not add unrelated fields or change API versions. This is a node configuration artifact; do not run kubectl apply against it.

Verification

Get-Content .\lab\lesson-15-kubelet-config-answer.yaml

The completed configuration should leave nothing listening on TCP 10255. In a real cluster, deploy it through the node’s kubelet configuration-management path and restart the kubelet only under the approved maintenance procedure.

Retrieval check

Question

Why is setting authorization.mode: Webhook insufficient if authentication.anonymous.enabled remains true?

Anonymous requests can still reach the kubelet and rely on whatever authorization is granted to the anonymous identity.Webhook authorization automatically closes port 10255.Authorization automatically rotates client certificates.

Documentation target

Use the official Kubernetes KubeletConfiguration API reference and the kubelet authentication/authorization documentation.

What to send me

Paste the replacement configuration. I’ll check every required field, then explain how the settings combine to secure the endpoint.