CKSKubernetes 1.35

Exercises

Exercise: harden the API server and survive it

updated 2026-10-22 by seed

Host: controlplane (root) · Time: 12 min · Domain: Cluster Hardening

Task

  • --enable-admission-plugins=NodeRestriction must be active.
  • Anonymous authentication must be disabled.
  • --authorization-mode must be Node,RBAC.

Acceptance criteria

  • ps -ef | grep kube-apiserver | tr ' ' '\n' | grep -E 'NodeRestriction|anonymous|authorization-mode' shows all three.
  • kubectl get --raw /healthz returns ok.
  • kubectl get nodes still works.

Solution

sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak
sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
    - --enable-admission-plugins=NodeRestriction
    - --anonymous-auth=false
    - --authorization-mode=Node,RBAC
sleep 20
kubectl get --raw /healthz
sudo crictl ps | grep kube-apiserver

When it breaks: sudo crictl ps -a | grep apiserver,
sudo crictl logs <id>, sudo journalctl -u kubelet -n 50. Fix the YAML, wait,
retry. The backup file is the fastest path to a working cluster if you cannot see
the mistake.