CertGrid CertGrid
Hands-on Lab·Certified Kubernetes Security Specialist

Least-Privilege Identity and Access on the Node

Identity and access management in this domain means the host's, not the cluster's: who can log in, what they can become, and what a shell on this machine is worth. This guide answers all three and finishes with four checks you can run on any node in ten seconds.

System Hardening Guide 15 of 40 Intermediate

This is a lab node and it does not pass every check. The guide says so rather than quietly using a hardened example.

The cka7001 cluster: one control plane and 1 schedulable worker, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA7001192.168.0.51Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA7001-NODE01192.168.0.52Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this when identity and access has to mean the host's rather than the cluster's. This matters because a shell on a node is worth whatever credentials are sitting on its disk, and those are readable long before any Kubernetes control applies.

Before you start

  1. Who can log in at all, and what they become

  2. How they get here

  3. What a shell on this node is worth

  4. The four checks worth running everywhere

Official sources

← All CKS guides