kube-apiserver Security Flags
The apiserver is the only way into the cluster, so its flags are the cluster's security posture. This guide reads them off the manifest and then tests one of them from outside with no credential at all - which reveals a default that is not in the file.
Cluster Component Security Guide 10 of 42 Intermediate
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 16 min
kubeadm's defaults for v1.36. --authorization-mode=Node,RBAC and --enable-admission-plugins=NodeRestriction are what kubeadm sets; a flag absent from the manifest means the apiserver's own default applies, and that is the trap this page is about.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when auditing a cluster and you get one place to start. This matters because the API server is the only way in, so its flags are the cluster's security posture - and a flag that is absent matters as much as the ones that are present.
- grepping the manifest for the security-relevant flags, and reading what comes back
- noticing the flag that is not there at all
- calling the API with no credential whatsoever, and reading exactly what it says
Before you start
- guide 9 - where these flags live.
-
What the manifest says
-
The flag that is not there