67 lines
1.6 KiB
Markdown
67 lines
1.6 KiB
Markdown
# CKS-010 — Remove an exposed dashboard endpoint
|
|
|
|
Domain: **1.4 Protect node metadata and endpoints**
|
|
Time: **4 minutes** · Score: **Section B only**
|
|
|
|
## Existing objects
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kubernetes-dashboard
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
type: NodePort
|
|
selector:
|
|
k8s-app: kubernetes-dashboard
|
|
ports:
|
|
- port: 443
|
|
targetPort: 8443
|
|
nodePort: 30443
|
|
---
|
|
apiVersion: rbac.authorization.k8s.io/v1
|
|
kind: ClusterRoleBinding
|
|
metadata:
|
|
name: dashboard-admin
|
|
subjects:
|
|
- kind: ServiceAccount
|
|
name: kubernetes-dashboard
|
|
namespace: kubernetes-dashboard
|
|
roleRef:
|
|
apiGroup: rbac.authorization.k8s.io
|
|
kind: ClusterRole
|
|
name: cluster-admin
|
|
```
|
|
|
|
## Task
|
|
|
|
The dashboard must remain reachable only inside the cluster and must no longer hold `cluster-admin` privileges. Modify/delete only what is necessary, then verify both outcomes.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
k create clusterrole dashboard-role --verb=get,list,update,delete,patch --resource=pods
|
|
k delete clusterrolebinding dashboard-admin
|
|
k create clusterrolebinding dashboard-role-binding --clusterrole=dashboard-role --serviceaccount=kubernetes-dashboard:kubernetes-dashborad
|
|
k auth can-i get pod --as=system:serviceaccount:kubernetes-cluster:kubernetes-cluster
|
|
k edit service kubernetes-dashboard -n kubernetes-dashboard
|
|
```
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: kubernetes-dashboard
|
|
namespace: kubernetes-dashboard
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
k8s-app: kubernetes-dashboard
|
|
ports:
|
|
- port: 443
|
|
targetPort: 8443
|
|
```
|
|
|
|
Say **Grade CKS-010** when saved.
|