CKS Security Quest · API access
Reject anonymous clients
Change one static-Pod flag, recover safely, and test both authenticated and anonymous paths.
Task
The complete exercise manifest is in ANSWER.md. Back it up outside the static-manifest directory, change --anonymous-auth=true, wait for recovery, verify /readyz with kubectl, and confirm an unauthenticated HTTPS request returns 401.