Completed upto lesson 35

lessons/0036-kube-bench-cis-triage.html

@@ -0,0 +1,73 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Lesson 36: kube-bench CIS triage</title>
+  <link rel="stylesheet" href="../assets/course.css">
+</head>
+<body>
+<main>
+  <p class="eyebrow">Lesson 0036 · 35 minutes · Tool drill · Cluster Setup</p>
+  <h1>Triage kube-bench findings without obeying the scanner blindly</h1>
+  <p class="lede">A scanner accelerates inspection; it does not replace component knowledge. Extract non-passing checks, verify them against configuration, identify uncovered components, and prioritize fixes by impact.</p>
+
+  <h2>Environment note</h2>
+  <p>The current Windows shell has no Docker, WSL, Kubernetes CLI, or Linux node access. Use the provided kube-bench JSON report for this training attempt. Hero remains unavailable until you rerun kube-bench on a Linux control-plane and worker node.</p>
+
+  <h2>Task: 25 minutes</h2>
+  <p>Analyze these files without modifying them:</p>
+  <ul>
+    <li><code>lab/lesson-36-kube-bench.json</code></li>
+    <li><code>lab/lesson-35-kube-apiserver-insecure.yaml</code></li>
+    <li><code>lab/lesson-36-etcd.yaml</code></li>
+    <li><code>lab/lesson-28-kubelet-review.yaml</code></li>
+    <li><code>lab/lesson-36-coredns.yaml</code></li>
+  </ul>
+  <p>Create <code>lab/lesson-36-answer.md</code> containing:</p>
+  <ol>
+    <li>The exact PowerShell command used to extract every non-PASS result from the JSON.</li>
+    <li>A table for all seven FAIL results and the one WARN result: check ID, component, status, scanner evidence, configuration evidence, verdict, and precise remediation.</li>
+    <li>Your first three remediations in operational priority order, with one sentence of justification each.</li>
+    <li>At least four security findings from the CoreDNS Deployment that kube-bench did not report.</li>
+    <li>One paragraph explaining why WARN does not mean FAIL, why PASS is not universal proof, and why CoreDNS requires manual review here.</li>
+    <li>The exact Linux commands you would use to install pinned kube-bench v0.16.0, verify its checksum, run control-plane/etcd/node/policies targets as root, save JSON, and make CI return a nonzero code when checks fail.</li>
+  </ol>
+
+  <div class="callout"><strong>Tool reflex:</strong> kube-bench has PASS, FAIL, WARN, and INFO states. A WARN commonly needs manual attention. A failed check can also reflect an execution or detection problem, so compare <code>actual_value</code> and <code>reason</code> with effective configuration before changing a node.</div>
+
+  <h2>PowerShell starting shape</h2>
+  <pre><code>$report = Get-Content .\lab\lesson-36-kube-bench.json -Raw | ConvertFrom-Json
+$report.Controls.tests.results |
+  Where-Object status -ne 'PASS' |
+  Select-Object test_number, status, test_desc, actual_value, reason</code></pre>
+
+  <h2>Linux Hero rerun shape</h2>
+  <pre><code># Run on a Linux node with access to component processes and files.
+sudo kube-bench run --targets master,etcd,node,policies \
+  --json --outputfile kube-bench.json --exit-code 42</code></pre>
+  <p>You must determine and record the complete pinned installation and checksum-verification commands yourself.</p>
+
+  <h2>Retrieval check</h2>
+  <div class="quiz">
+    <h3>Question</h3>
+    <p>kube-bench reports WARN for a manual check. What should you do?</p>
+    <label><input type="radio" name="q" value="verify">Inspect the effective configuration and record a manual verdict.</label>
+    <label><input type="radio" name="q" value="fail">Treat the warning as a proven configuration failure immediately.</label>
+    <label><input type="radio" name="q" value="ignore">Ignore the warning because only automated checks matter.</label>
+    <button onclick="check()">Check answer</button>
+    <p id="feedback" class="feedback" aria-live="polite"></p>
+  </div>
+
+  <h2>Documentation targets</h2>
+  <p>Use the official <a href="https://github.com/aquasecurity/kube-bench">kube-bench repository</a>, its <a href="https://github.com/aquasecurity/kube-bench/blob/main/docs/installation.md">installation guide</a>, and the applicable CIS benchmark guidance after your first analysis.</p>
+
+  <h2>What to send me</h2>
+  <p>Save the Markdown answer and say <em>check</em>. I will list every issue and correct one per round. This attempt can advance CS-02 training, but the Hero tool gate requires a later real-node run.</p>
+  <footer>Previous: <a href="0035-apiserver-audit-hard-mode.html">API server and audit hard mode</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer>
+</main>
+<script>
+function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='verify'){f.textContent='Correct. WARN requires a manual, evidence-based verdict.';f.className='feedback good';}else{f.textContent='Not quite. The scanner has not proved either compliance or failure.';f.className='feedback bad';}}
+</script>
+</body>
+</html>