ChaGPT added lab simulations
This commit is contained in:
Mosiur Rahman
57
lessons/0036-kube-bench-cis-remediation.html
Normal file
57
lessons/0036-kube-bench-cis-remediation.html
Normal file
@@ -0,0 +1,57 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||||
<title>Lesson 36: kube-bench CIS remediation</title>
|
||||
<link rel="stylesheet" href="../assets/course.css">
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<p class="eyebrow">Lesson 0036 · 25 minutes · Linux performance lab · Cluster Setup</p>
|
||||
<h1>Remediate kube-bench failures</h1>
|
||||
<p class="lede">Complete this task on disposable Linux hosts running a kubeadm-style Kubernetes v1.34 cluster with kube-bench v0.16.0. No written explanation is required.</p>
|
||||
|
||||
<div class="callout"><strong>Environment required:</strong> a disposable Kubernetes v1.34 lab with one control-plane host, one worker host, root access, kube-bench v0.16.0, and editable component configuration. Do not perform this training remediation on the learner's Kubernetes v1.36 production cluster: kube-bench v0.16.0 maps only through Kubernetes v1.34.</div>
|
||||
|
||||
<h2>Task</h2>
|
||||
<p>Start on host <code>controlplane</code>. Become root. Do not change any setting not named below.</p>
|
||||
|
||||
<ol>
|
||||
<li>Run kube-bench checks <code>1.2.1</code>, <code>1.2.7</code>, <code>2.2</code>, and <code>2.3</code>. Save the output to <code>/root/lesson-36-controlplane-before.txt</code>.</li>
|
||||
<li>Configure kube-apiserver with anonymous authentication disabled and authorization modes <code>Node,RBAC</code>.</li>
|
||||
<li>Configure etcd with client-certificate authentication enabled and automatic TLS disabled. Preserve its existing CA, certificate, key, peer, data, and cluster settings.</li>
|
||||
<li>Wait for kube-apiserver and etcd to become healthy.</li>
|
||||
<li>Rerun the same four checks and save output to <code>/root/lesson-36-controlplane-after.txt</code>. All four checks must report PASS.</li>
|
||||
</ol>
|
||||
|
||||
<p>Return to the base host, then connect directly to host <code>worker</code>. Become root.</p>
|
||||
|
||||
<ol start="6">
|
||||
<li>Run kube-bench checks <code>4.2.1</code>, <code>4.2.2</code>, and <code>4.2.3</code>. Save output to <code>/root/lesson-36-worker-before.txt</code>.</li>
|
||||
<li>Configure kubelet so anonymous authentication is disabled, webhook authentication is enabled, and authorization mode is <code>Webhook</code>.</li>
|
||||
<li>Restart kubelet and verify the node returns to <code>Ready</code>.</li>
|
||||
<li>Rerun the same three checks and save output to <code>/root/lesson-36-worker-after.txt</code>. All three checks must report PASS.</li>
|
||||
</ol>
|
||||
|
||||
<h2>Completion evidence</h2>
|
||||
<p>Send only these outputs:</p>
|
||||
<pre><code># controlplane
|
||||
grep -E '^\[(PASS|FAIL|WARN)\]' /root/lesson-36-controlplane-after.txt
|
||||
|
||||
# worker
|
||||
grep -E '^\[(PASS|FAIL|WARN)\]' /root/lesson-36-worker-after.txt
|
||||
systemctl is-active kubelet
|
||||
kubectl get node worker</code></pre>
|
||||
|
||||
<p>Do not submit an essay or remediation table. The result is graded from component state, saved scanner output, and node health.</p>
|
||||
|
||||
<h2>Documentation</h2>
|
||||
<p>Use the installed kube-bench help, component configuration files, and official <a href="https://github.com/aquasecurity/kube-bench">kube-bench documentation</a> as needed.</p>
|
||||
|
||||
<h2>What to send me</h2>
|
||||
<p>Send the four PASS groups, <code>systemctl</code> result, and worker-node status. I will list all detected issues and correct one per round.</p>
|
||||
<footer>Previous: <a href="0035-apiserver-audit-hard-mode.html">API server and audit hard mode</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer>
|
||||
</main>
|
||||
</body>
|
||||
</html>
|
||||
@@ -1,73 +0,0 @@
|
||||
<!doctype html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width,initial-scale=1">
|
||||
<title>Lesson 36: kube-bench CIS triage</title>
|
||||
<link rel="stylesheet" href="../assets/course.css">
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<p class="eyebrow">Lesson 0036 · 35 minutes · Tool drill · Cluster Setup</p>
|
||||
<h1>Triage kube-bench findings without obeying the scanner blindly</h1>
|
||||
<p class="lede">A scanner accelerates inspection; it does not replace component knowledge. Extract non-passing checks, verify them against configuration, identify uncovered components, and prioritize fixes by impact.</p>
|
||||
|
||||
<h2>Environment note</h2>
|
||||
<p>The current Windows shell has no Docker, WSL, Kubernetes CLI, or Linux node access. Use the provided kube-bench JSON report for this training attempt. Hero remains unavailable until you rerun kube-bench on a Linux control-plane and worker node.</p>
|
||||
|
||||
<h2>Task: 25 minutes</h2>
|
||||
<p>Analyze these files without modifying them:</p>
|
||||
<ul>
|
||||
<li><code>lab/lesson-36-kube-bench.json</code></li>
|
||||
<li><code>lab/lesson-35-kube-apiserver-insecure.yaml</code></li>
|
||||
<li><code>lab/lesson-36-etcd.yaml</code></li>
|
||||
<li><code>lab/lesson-28-kubelet-review.yaml</code></li>
|
||||
<li><code>lab/lesson-36-coredns.yaml</code></li>
|
||||
</ul>
|
||||
<p>Create <code>lab/lesson-36-answer.md</code> containing:</p>
|
||||
<ol>
|
||||
<li>The exact PowerShell command used to extract every non-PASS result from the JSON.</li>
|
||||
<li>A table for all seven FAIL results and the one WARN result: check ID, component, status, scanner evidence, configuration evidence, verdict, and precise remediation.</li>
|
||||
<li>Your first three remediations in operational priority order, with one sentence of justification each.</li>
|
||||
<li>At least four security findings from the CoreDNS Deployment that kube-bench did not report.</li>
|
||||
<li>One paragraph explaining why WARN does not mean FAIL, why PASS is not universal proof, and why CoreDNS requires manual review here.</li>
|
||||
<li>The exact Linux commands you would use to install pinned kube-bench v0.16.0, verify its checksum, run control-plane/etcd/node/policies targets as root, save JSON, and make CI return a nonzero code when checks fail.</li>
|
||||
</ol>
|
||||
|
||||
<div class="callout"><strong>Tool reflex:</strong> kube-bench has PASS, FAIL, WARN, and INFO states. A WARN commonly needs manual attention. A failed check can also reflect an execution or detection problem, so compare <code>actual_value</code> and <code>reason</code> with effective configuration before changing a node.</div>
|
||||
|
||||
<h2>PowerShell starting shape</h2>
|
||||
<pre><code>$report = Get-Content .\lab\lesson-36-kube-bench.json -Raw | ConvertFrom-Json
|
||||
$report.Controls.tests.results |
|
||||
Where-Object status -ne 'PASS' |
|
||||
Select-Object test_number, status, test_desc, actual_value, reason</code></pre>
|
||||
|
||||
<h2>Linux Hero rerun shape</h2>
|
||||
<pre><code># Run on a Linux node with access to component processes and files.
|
||||
sudo kube-bench run --targets master,etcd,node,policies \
|
||||
--json --outputfile kube-bench.json --exit-code 42</code></pre>
|
||||
<p>You must determine and record the complete pinned installation and checksum-verification commands yourself.</p>
|
||||
|
||||
<h2>Retrieval check</h2>
|
||||
<div class="quiz">
|
||||
<h3>Question</h3>
|
||||
<p>kube-bench reports WARN for a manual check. What should you do?</p>
|
||||
<label><input type="radio" name="q" value="verify">Inspect the effective configuration and record a manual verdict.</label>
|
||||
<label><input type="radio" name="q" value="fail">Treat the warning as a proven configuration failure immediately.</label>
|
||||
<label><input type="radio" name="q" value="ignore">Ignore the warning because only automated checks matter.</label>
|
||||
<button onclick="check()">Check answer</button>
|
||||
<p id="feedback" class="feedback" aria-live="polite"></p>
|
||||
</div>
|
||||
|
||||
<h2>Documentation targets</h2>
|
||||
<p>Use the official <a href="https://github.com/aquasecurity/kube-bench">kube-bench repository</a>, its <a href="https://github.com/aquasecurity/kube-bench/blob/main/docs/installation.md">installation guide</a>, and the applicable CIS benchmark guidance after your first analysis.</p>
|
||||
|
||||
<h2>What to send me</h2>
|
||||
<p>Save the Markdown answer and say <em>check</em>. I will list every issue and correct one per round. This attempt can advance CS-02 training, but the Hero tool gate requires a later real-node run.</p>
|
||||
<footer>Previous: <a href="0035-apiserver-audit-hard-mode.html">API server and audit hard mode</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer>
|
||||
</main>
|
||||
<script>
|
||||
function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='verify'){f.textContent='Correct. WARN requires a manual, evidence-based verdict.';f.className='feedback good';}else{f.textContent='Not quite. The scanner has not proved either compliance or failure.';f.className='feedback bad';}}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
Reference in New Issue
Block a user