Challenge
DifficultyHard
Learner activity No attempts yet

Secure the Kubernetes API Server: Disable Anonymous Auth and AlwaysAllow Authorization

Omkar Shelke
by  Omkar Shelke · on
Kubernetes
The API server was misconfigured with anonymous authentication enabled and authorization set to AlwaysAllow. A ClusterRoleBinding also grants explicit permissions to system:anonymous. Fix all three issues to secure the cluster.
#cka#apiserver#rbac#anonymous#authorization

Scenario

The cluster has three security misconfigurations that together allow unauthenticated, unrestricted access to the Kubernetes API — anyone who can reach port 6443 can query resources with no credentials.

Your job is to identify and close all three gaps.

Task

The API server manifest is at /etc/kubernetes/manifests/kube-apiserver.yaml.

Fix the following in the manifest:

  • Set --anonymous-auth=false
  • Replace --authorization-mode=AlwaysAllow with --authorization-mode=Node,RBAC

The kubelet will automatically restart the API server when the manifest changes.

Also delete the ClusterRoleBinding that grants permissions to system:anonymous:

kubectl get clusterrolebinding -o wide | grep anonymous

Once the API server restarts, anonymous requests must return 401 Unauthorized:

curl -k https://localhost:6443/api/v1/namespaces
Hint 1 — Fix Both Flags in the API Server Manifest

Grep for both flags to find the exact lines:

grep -n "anonymous-auth\|authorization-mode" \
  /etc/kubernetes/manifests/kube-apiserver.yaml

Edit the file and update both:

vi /etc/kubernetes/manifests/kube-apiserver.yaml
  • --anonymous-auth=true → --anonymous-auth=false
  • --authorization-mode=AlwaysAllow → --authorization-mode=Node,RBAC

Documentation

Hint 2 — Delete the ClusterRoleBinding for system:anonymous

List all ClusterRoleBindings referencing system:anonymous:

kubectl get clusterrolebinding -o wide | grep anonymous

Delete the binding:

kubectl delete clusterrolebinding anonymous-binding

Documentation

Hint 3 — Wait for the API Server to Restart and Verify

After saving the manifest changes, wait for the API server to come back:

kubectl wait --for=condition=Ready pod -l component=kube-apiserver \
  -n kube-system --timeout=90s

Then verify anonymous access is blocked:

curl -sk -o /dev/null -w "%{http_code}" \
  https://localhost:6443/api/v1/namespaces

401 = success. If you still get 200, check both flags in the manifest are correct and the pod has fully restarted.

Documentation

⚒ Test Cases

How to Author Challenges on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull challenge content

labctl content pull challenge disable-anonymous-auth-always-allow-authorization-anonymous-efc0cfec

This will create a local copy of the challenge content in a directory named disable-anonymous-auth-always-allow-authorization-anonymous-efc0cfec. You only need to do this once per challenge.

Stream your changes

labctl content push -fw challenge disable-anonymous-auth-always-allow-authorization-anonymous-efc0cfec

Run this command in a separate terminal to continuously upload your changes to the server while editing the challenge in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Problem
Start