I85PREP
⌘ K
KCSA study materials
KCSA study resources

KCSA: Kubernetes Cluster Component Security

KCSA · Work through your exam, one topic at a time.

All guide sections

Kubernetes Cluster Component Security

The Kubernetes Cluster Component Security domain is the largest on the exam and tests whether you know the default posture and the hardening flags of everything that makes a cluster run.

Control plane

  • kube-apiserver - serve TLS only (the insecure HTTP port is gone in current releases), set --anonymous-auth=false and --authorization-mode=Node,RBAC, enable admission plugins deliberately, turn on audit logging, and configure --kubelet-client-certificate/--kubelet-certificate-authority so API-to-kubelet traffic is mutually authenticated.
  • etcd - client and peer TLS, listening on a private interface, plus encryption at rest via EncryptionConfiguration (aescbc/aesgcm, or kms v2 for keys held outside the cluster). TLS protects data in transit; encryption at rest protects the disk and backups.
  • kube-controller-manager and kube-scheduler - bind health and metrics endpoints to 127.0.0.1, and run the controller manager with --use-service-account-credentials so each controller gets its own identity.
  • NodeRestriction - admission plugin limiting a kubelet to its own Node object and its own pods.

Nodes

kubelet: --anonymous-auth=false, --authorization-mode=Webhook, --client-ca-file, --rotate-certificates, --protect-kernel-defaults=true. The read-only port 10255 was removed; port 10250 is TLS but answers unauthenticated callers when anonymous auth is on. kube-proxy metrics should not be publicly bound, and the container runtime socket (containerd/CRI-O) must be root-only, because write access to it is equivalent to root on the node.

Worked example

curl -k https://NODE:10250/pods returns a pod list. Diagnosis: kubelet anonymous authentication is enabled and the authorization mode permits the request (historically AlwaysAllow). Fix: authentication.anonymous.enabled: false and authorization.mode: Webhook in the kubelet config, then restart the kubelet.

Traps

Confusing etcd TLS with at-rest encryption; assuming kubelet authorization defaults to Webhook everywhere; leaving system:masters bindings in place.