Hands-on Lab·Certified Kubernetes Security Specialist
Restricting Kubernetes API Access
Restricting API access means three different things - who may call without a credential, what they get if they do, and who can reach the endpoint at all. This guide measures all three on a live cluster and closes the third with one policy.
Cluster Hardening Guide 12 of 40 Advanced
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 18 min
--anonymous-auth is not set on this apiserver, so it defaults to true. Authorization mode is Node,RBAC, which is what turns an anonymous request into a 403 rather than a 200.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA6001 | 192.168.0.46 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA6001-NODE01 | 192.168.0.47 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA6001-NODE02 | 192.168.0.48 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when API access has to be restricted, which turns out to mean three separate things. This matters because anonymous access defaults to on, and every Pod in the cluster can reach the control plane unless something stops it.
- sending three requests with no credential at all, and reading what comes back
- reading the flags the apiserver was given, and the bindings the cluster already grants
- confirming every Pod can reach the control plane, and writing the policy that fixes it
Before you start
-
What the apiserver answers with no credential at all
-
The flags and the bindings that decide it
-
Every Pod can reach the control plane