CKS Security Quest · Endpoint protection

Contain the dashboard

Remove public exposure and cluster-wide administrative privilege.

CKS-0104 minutes

Task

The supplied dashboard Service is NodePort on 30443. ClusterRoleBinding dashboard-admin grants its ServiceAccount cluster-admin.

Keep the dashboard reachable inside the cluster, remove cluster-admin access, and verify both outcomes. Modify/delete only what is necessary.