CKS Practice Question: Which flag should you set on the kube-apiserver…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  --disable-anonymous=true

  Why it's wrong here

  The kube-apiserver does not expose a flag named --disable-anonymous. Anonymous access is controlled by the --anonymous-auth flag, which is a boolean that defaults to true. Setting --disable-anonymous=true would be rejected as an invalid flag or ignored, so it cannot disable anonymous authentication. The only correct way to disable it is to pass --anonymous-auth=false on the apiserver command line or in its static pod manifest.

• ✓

  --anonymous-auth=false

  Why this is correct

  Setting --anonymous-auth=false instructs the kube-apiserver to reject any request that does not arrive with valid credentials from one of its configured authenticators (client certificates, bearer tokens, OIDC, webhooks). Without this flag, unauthenticated requests are mapped to the system:anonymous user and system:unauthenticated group and proceed to the authorization stage, where RBAC rules or other authorizers may or may not have permissions. Disabling anonymous authentication means such requests immediately get a 401 Unauthorized response, effectively reducing the attack surface for pre-auth exploitation.

• ✗

  --enable-anonymous-auth=false

  Why it's wrong here

  There is no such apiserver option as --enable-anonymous-auth. The existing boolean flag is called --anonymous-auth, and its default is true, so enabling anonymous authentication is already the default. Attempting to use --enable-anonymous-auth=false is invalid and will cause a configuration error, and even if the apiserver started, it would not have the intended effect. To disable anonymous access, you must explicitly set --anonymous-auth=false.

• ✗

  --auth-mode=RBAC

  Why it's wrong here

  The flag --auth-mode=RBAC is not a valid kube-apiserver flag; the correct flag for controlling authorization is --authorization-mode=RBAC. More importantly, this flag would only affect how requests are authorized after authentication, not whether anonymous requests are accepted. Even with RBAC as the authorization mode, anonymous requests reach the authorizer, and if RBAC rules accidentally grant permissions to system:unauthenticated or system:authenticated groups, they can still access resources. Therefore it is orthogonal to --anonymous-auth.

Go deeper

Related to this question