MENU
Context
The kubeadm-created cluster's Kubernetes API server was, for testing purposes, temporarily configured to allow unauthenticated and unauthorized access granting the anonymous user duster-admin access.
Task
Reconfigure the cluster's Kubernetes API server to ensure that only authenticated and authorized REST requests are allowed.
Use authorization mode Node,RBAC and admission controller NodeRestriction.
Cleaning up, remove the ClusterRoleBinding for user system:anonymous.
Suggested Answer: A
Get Premium CKS Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
11 comments · newest first
DA
Daryl
12 months ago
I don't think removing system:anonymous is enough, we need more layers.
LA
Laurel
1 year ago
RBAC and NodeRestriction are essential for security.
EF
Effie
1 year ago
Wait, they actually gave anonymous users admin access? That's wild!
YU
Yuette
1 year ago
Totally agree, leaving it open is a big no-no.
MA
Mariann
1 year ago
Just a reminder, always secure your API server!
KA
Karon
1 year ago
I definitely remember cleaning up the ClusterRoleBinding for system:anonymous, but I might need to double-check the command syntax.
AB
Abraham
1 year ago
The admission controller NodeRestriction is crucial here, right? I hope I can recall the exact steps to apply it during the exam.
RO
Royce
1 year ago
I think we need to edit the kube-apiserver manifest to include the Node and RBAC modes, but I might be mixing it up with another question we did.
DE
Derick
1 year ago
I remember we practiced configuring the API server with RBAC, but I'm not entirely sure how to set the authorization modes correctly.
HE
Herminia
1 year ago
Hmm, I'm a little unsure about this one. The question mentions several different Gas-related terms, and I want to make sure I understand the differences between them before answering. I might need to review my notes on Gas again.
CH
Chau
1 year ago
Okay, I've got this. The question is asking about the capabilities of the production floor execution interface, so I'll select the options that seem to match those capabilities.