mosiur/CKS-Lessons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

completed upto lab 38

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-27 14:03:17 +06:00
parent d74b79cfc6
commit ac6292db20
19 changed files with 220 additions and 204 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
lab/lesson-36-controlplane-after.txt Normal file
View File

@@ -0,0 +1,17 @@
root@cks-lab-control-plane:/opt/kube-bench# ./kube-bench --benchmark cis-1.12 --config-dir cfg run --targets master --check 1.2.1,1.2.7,2.2,2.3
[INFO] 1 Control Plane Security Configuration
[INFO] 1.2 API Server
[PASS] 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)
[PASS] 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)
== Summary master ==
2 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
== Summary total ==
2 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO

183
lab/lesson-36-controlplane-before.txt
View File

@@ -1,6 +1,7 @@
[INFO] 1 Control Plane Security Configuration
[INFO] 1.2 API Server
[WARN] 1.2.1 Ensure that the --anonymous-auth argument is set to false (Manual)
[PASS] 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)
== Remediations master ==
1.2.1 Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
@@ -9,191 +10,13 @@ on the control plane node and set the below parameter.
== Summary master ==
0 checks PASS
1 checks PASS
0 checks FAIL
1 checks WARN
0 checks INFO
[INFO] 2 Etcd Node Configuration
== Summary etcd ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 3 Control Plane Configuration
== Summary controlplane ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 4 Worker Node Security Configuration
== Summary node ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 5 Kubernetes Policies
== Summary policies ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
== Summary total ==
0 checks PASS
1 checks PASS
0 checks FAIL
1 checks WARN
0 checks INFO
[INFO] 1 Control Plane Security Configuration
[INFO] 1.2 API Server
[PASS] 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)
== Summary master ==
1 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 2 Etcd Node Configuration
== Summary etcd ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 3 Control Plane Configuration
== Summary controlplane ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 4 Worker Node Security Configuration
== Summary node ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 5 Kubernetes Policies
== Summary policies ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
== Summary total ==
1 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 1 Control Plane Security Configuration
== Summary master ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 2 Etcd Node Configuration
[INFO] 2 Etcd Node Configuration
[PASS] 2.2 Ensure that the --client-cert-auth argument is set to true (Automated)
== Summary etcd ==
1 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 3 Control Plane Configuration
== Summary controlplane ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 4 Worker Node Security Configuration
== Summary node ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 5 Kubernetes Policies
== Summary policies ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
== Summary total ==
1 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 1 Control Plane Security Configuration
== Summary master ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 2 Etcd Node Configuration
[INFO] 2 Etcd Node Configuration
[PASS] 2.3 Ensure that the --auto-tls argument is not set to true (Automated)
== Summary etcd ==
1 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 3 Control Plane Configuration
== Summary controlplane ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 4 Worker Node Security Configuration
== Summary node ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
[INFO] 5 Kubernetes Policies
== Summary policies ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
== Summary total ==
1 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO

15
lab/lesson-36-worker-before.txt Normal file
View File

@@ -0,0 +1,15 @@
root@cks-lab-worker:/opt/kube-bench# ./kube-bench --benchmark cis-1.12 --config-dir cfg run --targets master --check 4.2.1,4.2.2,4.2.3
Warning: Kubernetes version was not auto-detected because kubectl could not connect to the Kubernetes server. This may be because the kubeconfig information is missing or has credentials that do not match the server. Assuming default version 1.18
[INFO] 1 Control Plane Security Configuration
== Summary master ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO
== Summary total ==
0 checks PASS
0 checks FAIL
0 checks WARN
0 checks INFO

47
lab/lesson-37-etcd-insecure.yaml Normal file
View File

@@ -0,0 +1,47 @@
apiVersion: v1
kind: Pod
metadata:
name: etcd
namespace: kube-system
labels:
component: etcd
spec:
hostNetwork: true
containers:
- name: etcd
image: registry.k8s.io/etcd:3.6.4-0
command:
- etcd
- --name=controlplane
- --data-dir=/var/lib/etcd
- --listen-client-urls=http://127.0.0.1:2379,https://10.0.0.10:2379
- --advertise-client-urls=https://10.0.0.10:2379
- --initial-advertise-peer-urls=https://10.0.0.10:2380
- --listen-peer-urls=https://10.0.0.10:2380
- --initial-cluster=controlplane=https://10.0.0.10:2380
- --client-cert-auth=false
- --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
- --cert-file=/etc/kubernetes/pki/etcd/server.crt
- --key-file=/etc/kubernetes/pki/etcd/server.key
- --auto-tls=true
- --peer-client-cert-auth=false
- --peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt
- --peer-cert-file=/etc/kubernetes/pki/etcd/peer.crt
- --peer-key-file=/etc/kubernetes/pki/etcd/peer.key
- --peer-auto-tls=true
- --listen-metrics-urls=http://0.0.0.0:2381
volumeMounts:
- name: etcd-data
mountPath: /var/lib/etcd
- name: etcd-certs
mountPath: /etc/kubernetes/pki/etcd
readOnly: true
volumes:
- name: etcd-data
hostPath:
path: /var/lib/etcd
type: DirectoryOrCreate
- name: etcd-certs
hostPath:
path: /etc/kubernetes/pki/etcd
type: DirectoryOrCreate

28
lab/lesson-37-verify.sh Normal file
View File

@@ -0,0 +1,28 @@
#!/usr/bin/env bash
set -Eeuo pipefail
manifest=${1:?Usage: lesson-37-verify.sh PATH_TO_MANIFEST}
[[ -f "$manifest" ]] || { echo "FAIL manifest not found"; exit 1; }
required=(
'--client-cert-auth=true'
'--auto-tls=false'
'--peer-client-cert-auth=true'
'--peer-auto-tls=false'
'--trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt'
'--peer-trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt'
'--listen-metrics-urls=http://127.0.0.1:2381'
)
for flag in "${required[@]}"; do
if grep -Fqx " - $flag" "$manifest"; then
echo "PASS $flag"
else
echo "FAIL $flag"
fi
done
if grep -Eq 'http://0\.0\.0\.0:2381|http://127\.0\.0\.1:2379' "$manifest"; then
echo 'FAIL insecure etcd listener remains'
else
echo 'PASS no insecure etcd listener'
fi

1
lab/lesson-38-effective-args.txt Normal file
View File

@@ -0,0 +1 @@
/usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/tmp/lesson-38-kubelet.yaml --anonymous-auth=false --authentication-token-webhook=true --authorization-mode=Webhook --read-only-port=0 --rotate-certificates=true

11
lab/lesson-38-kubelet-config.yaml Normal file
View File

@@ -0,0 +1,11 @@
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
anonymous:
enabled: true
webhook:
enabled: false
authorization:
mode: AlwaysAllow
readOnlyPort: 10255
rotateCertificates: false

17
lab/lesson-38-verify.sh Normal file
View File

@@ -0,0 +1,17 @@
#!/usr/bin/env bash
set -Eeuo pipefail
config=${1:?Usage: lesson-38-verify.sh PATH_TO_CONFIG}
[[ -f "$config" ]] || { echo "FAIL configuration not found"; exit 1; }
check() {
local label=$1 expected=$2 query=$3 actual
actual="$(yq -r "$query" "$config")"
if [[ "$actual" == "$expected" ]]; then echo "PASS $label"; else echo "FAIL $label (got: $actual)"; fi
}
check 'anonymous authentication disabled' false '.authentication.anonymous.enabled'
check 'webhook authentication enabled' true '.authentication.webhook.enabled'
check 'webhook authorization selected' Webhook '.authorization.mode'
check 'read-only port disabled' 0 '.readOnlyPort'
check 'certificate rotation enabled' true '.rotateCertificates'