mosiur/CKS-Lessons
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

completed upto lab 38

Browse Source
This commit is contained in:
Mosiur Rahman
2026-08-27 14:03:17 +06:00
parent d74b79cfc6
commit ac6292db20
19 changed files with 220 additions and 204 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lessons/0037-etcd-static-manifest-hardening.html Normal file
View File

@@ -0,0 +1,4 @@
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 37: etcd static-manifest hardening</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0037 · 15 minutes · Linux performance lab · Cluster Setup</p><h1>Harden etcd without breaking membership</h1><p class="lede">This is a focused CIS remediation drill. It deliberately removes the cluster-entry and package-installation friction from the previous attempt.</p><div class="callout"><strong>Scope discipline:</strong> change only the insecure transport, authentication, and metrics flags. Preserve identity, data, listen/advertise peer addresses, initial cluster membership, certificates, mounts, and image.</div><h2>Task</h2><p>On the Linux lab shell, create <code>/tmp/lesson-37-etcd.yaml</code> from <code>lab/lesson-37-etcd-insecure.yaml</code>. Make it pass the supplied verifier.</p><ul><li>Require client and peer client certificates.</li><li>Disable automatic TLS for both client and peer traffic.</li><li>Keep the existing explicit CA, certificate, and key paths.</li><li>Ensure client traffic uses HTTPS only.</li><li>Bind the metrics listener only to <code>127.0.0.1:2381</code>.</li></ul><p>Do not edit the original fixture or verifier. Do not use <code>kubectl apply</code>; this is a static-manifest file exercise.</p><h2>Start and prove it</h2><pre><code>cd /mnt/c/Cloud-Team/04_Learning_and_Reference/Training/CKS
cp lab/lesson-37-etcd-insecure.yaml /tmp/lesson-37-etcd.yaml
nano /tmp/lesson-37-etcd.yaml
bash lab/lesson-37-verify.sh /tmp/lesson-37-etcd.yaml</code></pre><p>Completion means every line reports <code>PASS</code>. Send that output only.</p><h2>Documentation</h2><p>Use the official <a href="https://etcd.io/docs/v3.6/op-guide/security/">etcd transport security guide</a> if needed. The CKS objective is preserving the required configuration while closing only the proven exposure.</p><footer>Previous: <a href="0036-kube-bench-cis-remediation.html">kube-bench CIS remediation</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer></main></body></html>

6
lessons/0038-kubelet-effective-configuration.html Normal file
View File

@@ -0,0 +1,6 @@
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 38: kubelet effective configuration</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0038 · 15 minutes · Linux performance lab · Cluster Setup</p><h1>Reconcile kubelet configuration with effective flags</h1><p class="lede">Kubelet security faults often come from believing a configuration file is the whole truth. Inspect the effective arguments, then make the structured configuration agree with the required boundary.</p><div class="callout"><strong>Scope:</strong> the effective arguments in this task are the approved cluster policy. Correct the supplied <code>KubeletConfiguration</code>; do not change the argument file or add unrelated fields.</div><h2>Task</h2><p>On the Linux lab shell, create <code>/tmp/lesson-38-kubelet.yaml</code> from <code>lab/lesson-38-kubelet-config.yaml</code>. It must match the security posture expressed by <code>lab/lesson-38-effective-args.txt</code>.</p><p>Bring all five controls into agreement: anonymous authentication, webhook authentication, authorization mode, read-only port, and certificate rotation.</p><h2>Start and verify</h2><pre><code>cd /mnt/c/Cloud-Team/04_Learning_and_Reference/Training/CKS
cat lab/lesson-38-effective-args.txt
cp lab/lesson-38-kubelet-config.yaml /tmp/lesson-38-kubelet.yaml
nano /tmp/lesson-38-kubelet.yaml
bash lab/lesson-38-verify.sh /tmp/lesson-38-kubelet.yaml</code></pre><p>Completion means five <code>PASS</code> lines. Send only that output.</p><h2>Exam-speed inspection</h2><pre><code>docker exec cks-lab-worker ps -ef | grep '[k]ubelet'
docker exec cks-lab-worker sed -n '1,120p' /var/lib/kubelet/config.yaml</code></pre><p>Use these after the task to compare the fixture with the real disposable worker. Do not modify the live worker configuration for this drill.</p><footer>Previous: <a href="0037-etcd-static-manifest-hardening.html">etcd static-manifest hardening</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer></main></body></html>