CKS Practice Question: Which flag on the kubelet disables anonymous…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  --anonymous-auth=false

  Why this is correct

  The kubelet controls anonymous access through the --anonymous-auth flag, which is a boolean parameter that defaults to true. Setting this flag to false is the exact, documented mechanism to require authentication for every request to the kubelet's HTTPS endpoint, including requests from the kube-apiserver. This matches the equivalent flag used on the Kubernetes API server, making it the correct and precise way to disable unauthenticated access.

• ✗

  --disable-anonymous

  Why it's wrong here

  The kubelet does not have a --disable-anonymous flag in its configuration schema. Kubernetes flags are typically named after the setting they modify, and the actual flag is --anonymous-auth, which must be set to the explicit boolean value false. Since --disable-anonymous is not a recognized kubelet flag, issuing it would cause the kubelet to exit with an 'unknown flag' error, leaving anonymous access in its default enabled state.

• ✗

  --no-anonymous

  Why it's wrong here

  There is no --no-anonymous boolean flag accepted by the kubelet. While a 'no-' prefix might intuitively appear to negate a feature, Kubernetes flags are not generally constructed that way; instead, they take an explicit value. To disable anonymous authentication, the correct syntax is --anonymous-auth=false, which clarifies the setting's state. Using a fabricated flag like --no-anonymous would be ignored or rejected, and would not alter the kubelet's authentication policy.

• ✗

  --enable-anonymous-auth=false

  Why it's wrong here

  Although --enable-anonymous-auth=false might seem like a logical negation of an 'enable' flag, the kubelet's real configuration parameter is simply --anonymous-auth. The 'enable' prefix is not used for this particular setting, and the kubelet does not recognize --enable-anonymous-auth. Passing this incorrect flag would result in a command-line parse error, meaning the kubelet would not start or would continue using the default anonymous-auth=true, leaving anonymous access enabled.