CKS_FINALE

submissions/CKS-018-completed.md

@@ -0,0 +1,97 @@
+# CKS-018 — Disable anonymous API access
+
+Domain: **2.3 Restrict Kubernetes API access**  
+Time: **5 minutes** · Score: **Section B only**
+
+## Complete exercise manifest
+
+`/etc/kubernetes/manifests/kube-apiserver.yaml`:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kube-apiserver
+  namespace: kube-system
+spec:
+  hostNetwork: true
+  containers:
+  - name: kube-apiserver
+    image: registry.k8s.io/kube-apiserver:v1.35.0
+    command:
+    - kube-apiserver
+    - --advertise-address=10.0.0.10
+    - --anonymous-auth=true
+    - --authorization-mode=Node,RBAC
+    - --client-ca-file=/etc/kubernetes/pki/ca.crt
+    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
+    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
+    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
+    - --etcd-servers=https://127.0.0.1:2379
+    - --secure-port=6443
+    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
+    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
+    volumeMounts:
+    - name: pki
+      mountPath: /etc/kubernetes/pki
+      readOnly: true
+  volumes:
+  - name: pki
+    hostPath:
+      path: /etc/kubernetes/pki
+      type: DirectoryOrCreate
+```
+
+## Task
+
+Back up the manifest outside its directory, disable anonymous authentication, wait for API recovery, then verify authenticated readiness and that an unauthenticated request to `https://127.0.0.1:6443/api` returns HTTP `401`.
+
+## Section B — scored answer
+
+```bash
+cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/kube-apiserver.yaml-$(date +%Y-%m-%d)
+nano /etc/kubernetes/manifests/kube-apiserver.yaml
+```
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: kube-apiserver
+  namespace: kube-system
+spec:
+  hostNetwork: true
+  containers:
+  - name: kube-apiserver
+    image: registry.k8s.io/kube-apiserver:v1.35.0
+    command:
+    - kube-apiserver
+    - --advertise-address=10.0.0.10
+    - --anonymous-auth=false
+    - --authorization-mode=Node,RBAC
+    - --client-ca-file=/etc/kubernetes/pki/ca.crt
+    - --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
+    - --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
+    - --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
+    - --etcd-servers=https://127.0.0.1:2379
+    - --secure-port=6443
+    - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
+    - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
+    volumeMounts:
+    - name: pki
+      mountPath: /etc/kubernetes/pki
+      readOnly: true
+  volumes:
+  - name: pki
+    hostPath:
+      path: /etc/kubernetes/pki
+      type: DirectoryOrCreate
+```
+
+```bash
+kubectl get --raw='/readyz'
+curl -k -s -o /dev/null -w "%{http_code}\n" https://127.0.0.1:6443/api 
+
+```
+
+Say **Grade CKS-018** when saved.