# CKS-019 — Protect administrator kubeconfig

Domain: **2.3 Restrict Kubernetes API access**  
Time: **2 minutes** · Reward: **100 XP + topic mastery**

## Task

On `controlplane`:

```text
/etc/kubernetes/admin.conf  mode=0644 owner=root group=root
```

Back it up to `/root/admin.conf.backup`, change only its mode to `0600`, and verify numeric mode plus `owner:group`.

## Section B — scored answer

```bash
cp /etc/kubernetes/admin.conf /root/admin.conf.backup
chmod 0600 /etc/kubernetes/admin.conf
stat /etc/kubernetes/admin.conf
```

Say **Grade CKS-019** when saved.