98 lines
2.7 KiB
Markdown
98 lines
2.7 KiB
Markdown
# CKS-018 — Disable anonymous API access
|
|
|
|
Domain: **2.3 Restrict Kubernetes API access**
|
|
Time: **5 minutes** · Score: **Section B only**
|
|
|
|
## Complete exercise manifest
|
|
|
|
`/etc/kubernetes/manifests/kube-apiserver.yaml`:
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: kube-apiserver
|
|
namespace: kube-system
|
|
spec:
|
|
hostNetwork: true
|
|
containers:
|
|
- name: kube-apiserver
|
|
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
command:
|
|
- kube-apiserver
|
|
- --advertise-address=10.0.0.10
|
|
- --anonymous-auth=true
|
|
- --authorization-mode=Node,RBAC
|
|
- --client-ca-file=/etc/kubernetes/pki/ca.crt
|
|
- --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
|
|
- --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
|
|
- --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
|
|
- --etcd-servers=https://127.0.0.1:2379
|
|
- --secure-port=6443
|
|
- --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
|
|
- --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
|
|
volumeMounts:
|
|
- name: pki
|
|
mountPath: /etc/kubernetes/pki
|
|
readOnly: true
|
|
volumes:
|
|
- name: pki
|
|
hostPath:
|
|
path: /etc/kubernetes/pki
|
|
type: DirectoryOrCreate
|
|
```
|
|
|
|
## Task
|
|
|
|
Back up the manifest outside its directory, disable anonymous authentication, wait for API recovery, then verify authenticated readiness and that an unauthenticated request to `https://127.0.0.1:6443/api` returns HTTP `401`.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/kube-apiserver.yaml-$(date +%Y-%m-%d)
|
|
nano /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
```
|
|
|
|
```yaml
|
|
apiVersion: v1
|
|
kind: Pod
|
|
metadata:
|
|
name: kube-apiserver
|
|
namespace: kube-system
|
|
spec:
|
|
hostNetwork: true
|
|
containers:
|
|
- name: kube-apiserver
|
|
image: registry.k8s.io/kube-apiserver:v1.35.0
|
|
command:
|
|
- kube-apiserver
|
|
- --advertise-address=10.0.0.10
|
|
- --anonymous-auth=false
|
|
- --authorization-mode=Node,RBAC
|
|
- --client-ca-file=/etc/kubernetes/pki/ca.crt
|
|
- --etcd-cafile=/etc/kubernetes/pki/etcd/ca.crt
|
|
- --etcd-certfile=/etc/kubernetes/pki/apiserver-etcd-client.crt
|
|
- --etcd-keyfile=/etc/kubernetes/pki/apiserver-etcd-client.key
|
|
- --etcd-servers=https://127.0.0.1:2379
|
|
- --secure-port=6443
|
|
- --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
|
|
- --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
|
|
volumeMounts:
|
|
- name: pki
|
|
mountPath: /etc/kubernetes/pki
|
|
readOnly: true
|
|
volumes:
|
|
- name: pki
|
|
hostPath:
|
|
path: /etc/kubernetes/pki
|
|
type: DirectoryOrCreate
|
|
```
|
|
|
|
```bash
|
|
kubectl get --raw='/readyz'
|
|
curl -k -s -o /dev/null -w "%{http_code}\n" https://127.0.0.1:6443/api
|
|
|
|
```
|
|
|
|
Say **Grade CKS-018** when saved.
|