# Kubelet configuration and effective flags

The learner reconciled an insecure KubeletConfiguration with approved effective flags, independently setting anonymous authentication off, webhook authentication and authorization on, the read-only port to zero, and certificate rotation on. Future CIS practice can now combine configuration-file review with process-argument verification.

## Evidence

`lab/lesson-38-verify.sh /tmp/lesson-38-kubelet.yaml` reported all five controls as PASS on 2026-08-27.