CKS_FINALE

submissions/CKS-010-incomplete.md

@@ -0,0 +1,66 @@
+# CKS-010 — Remove an exposed dashboard endpoint
+
+Domain: **1.4 Protect node metadata and endpoints**  
+Time: **4 minutes** · Score: **Section B only**
+
+## Existing objects
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  type: NodePort
+  selector:
+    k8s-app: kubernetes-dashboard
+  ports:
+  - port: 443
+    targetPort: 8443
+    nodePort: 30443
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dashboard-admin
+subjects:
+- kind: ServiceAccount
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: cluster-admin
+```
+
+## Task
+
+The dashboard must remain reachable only inside the cluster and must no longer hold `cluster-admin` privileges. Modify/delete only what is necessary, then verify both outcomes.
+
+## Section B — scored answer
+
+```bash
+k create clusterrole dashboard-role --verb=get,list,update,delete,patch --resource=pods
+k delete clusterrolebinding dashboard-admin 
+k create clusterrolebinding dashboard-role-binding --clusterrole=dashboard-role --serviceaccount=kubernetes-dashboard:kubernetes-dashborad
+k auth can-i get pod --as=system:serviceaccount:kubernetes-cluster:kubernetes-cluster
+k edit service kubernetes-dashboard -n kubernetes-dashboard
+```
+
+```yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: kubernetes-dashboard
+  namespace: kubernetes-dashboard
+spec:
+  type: ClusterIP
+  selector:
+    k8s-app: kubernetes-dashboard
+  ports:
+  - port: 443
+    targetPort: 8443
+```
+
+Say **Grade CKS-010** when saved.