CKS-019 — Protect administrator kubeconfig

Domain: 2.3 Restrict Kubernetes API access
Time: 2 minutes · Reward: 100 XP + topic mastery

Task

On controlplane:

/etc/kubernetes/admin.conf  mode=0644 owner=root group=root

Back it up to /root/admin.conf.backup, change only its mode to 0600, and verify numeric mode plus owner:group.

cp /etc/kubernetes/admin.conf /root/admin.conf.backup
chmod 0600 /etc/kubernetes/admin.conf
stat /etc/kubernetes/admin.conf

Say Grade CKS-019 when saved.