mediumMultiple ChoiceObjective-mapped
CKS Practice Question: Which admission plugin should be enabled on the…
Which admission plugin should be enabled on the kube-apiserver to restrict kubelet permissions and prevent nodes from modifying their own Node objects?
⚠ Common exam trap
Watch out — candidates often confuse admission plugins that restrict pod behavior (like PodSecurityPolicy or AlwaysPullImages) with those that restrict node/kubelet behavior, leading them to pick a security-focused but irrelevant option for this specific kubelet permission control question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
NodeRestriction
The NodeRestriction admission plugin limits the kubelet's permissions to only modify labels, annotations, and status on its own Node object, preventing a compromised or misconfigured node from altering other Node objects or escalating privileges. This is a critical hardening measure for cluster setup, as it enforces the principle of least privilege on kubelet API access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ServiceAccount
Why it's wrong here
The ServiceAccount admission plugin is responsible for assigning service accounts to newly created pods and controlling whether pod service account tokens are automounted into containers. It manages pod-level identity and token propagation, but it has no bearing on kubelet authorization or which node or pod objects a kubelet may modify. Enabling it does nothing to restrict a compromised kubelet from mutating its own Node resource.
- ✗
AlwaysPullImages
Why it's wrong here
AlwaysPullImages is an admission controller that forces every pod's imagePullPolicy to Always, ensuring that images are always pulled fresh from the registry rather than reused from a node's local cache. This helps prevent stale or tampered images, but it only affects image retrieval behavior and does not place any constraint on kubelet actions. Consequently, it cannot prevent a kubelet from writing to its Node object or altering bound pods.
- ✓
NodeRestriction
Why this is correct
NodeRestriction is a built-in admission plugin that limits the kubelet to modifying only its own Node object and the Pod objects that are bound to that node. It works with the Node authorizer to enforce that each kubelet has a virtual identity scoped to its specific node, blocking attempts to alter other nodes or unbound pods. This directly addresses the threat of a compromised kubelet tampering with cluster state, making it the correct plugin to enable for kubelet restriction.
- ✗
PodSecurityPolicy
Why it's wrong here
PodSecurityPolicy (PSP) was a cluster-level admission controller that governed Pod security context settings, such as privileged containers, host namespaces, and allowed capabilities. It was deprecated in Kubernetes 1.21 and removed in 1.25, and it focused exclusively on controlling pod security aspects, not on restricting kubelet node-level writes. Since PSP never addressed kubelet authorization and is no longer available, it is not a valid solution for this requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CKS question from scratch — 114 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CKS practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CKS exam.