# CKS-010 — Remove an exposed dashboard endpoint

Domain: **1.4 Protect node metadata and endpoints**  
Time: **4 minutes** · Score: **Section B only**

## Existing objects

```yaml
apiVersion: v1
kind: Service
metadata:
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: NodePort
  selector:
    k8s-app: kubernetes-dashboard
  ports:
  - port: 443
    targetPort: 8443
    nodePort: 30443
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: dashboard-admin
subjects:
- kind: ServiceAccount
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
```

## Task

The dashboard must remain reachable only inside the cluster and must no longer hold `cluster-admin` privileges. Modify/delete only what is necessary, then verify both outcomes.

## Section B — scored answer

```bash
k create clusterrole dashboard-role --verb=get,list,update,delete,patch --resource=pods
k delete clusterrolebinding dashboard-admin 
k create clusterrolebinding dashboard-role-binding --clusterrole=dashboard-role --serviceaccount=kubernetes-dashboard:kubernetes-dashborad
k auth can-i get pod --as=system:serviceaccount:kubernetes-cluster:kubernetes-cluster
k edit service kubernetes-dashboard -n kubernetes-dashboard
```

```yaml
apiVersion: v1
kind: Service
metadata:
  name: kubernetes-dashboard
  namespace: kubernetes-dashboard
spec:
  type: ClusterIP
  selector:
    k8s-app: kubernetes-dashboard
  ports:
  - port: 443
    targetPort: 8443
```

Say **Grade CKS-010** when saved.