Lesson 0038 · 15 minutes · Linux performance lab · Cluster Setup

Reconcile kubelet configuration with effective flags

Kubelet security faults often come from believing a configuration file is the whole truth. Inspect the effective arguments, then make the structured configuration agree with the required boundary.

Scope: the effective arguments in this task are the approved cluster policy. Correct the supplied KubeletConfiguration; do not change the argument file or add unrelated fields.

Task

On the Linux lab shell, create /tmp/lesson-38-kubelet.yaml from lab/lesson-38-kubelet-config.yaml. It must match the security posture expressed by lab/lesson-38-effective-args.txt.

Bring all five controls into agreement: anonymous authentication, webhook authentication, authorization mode, read-only port, and certificate rotation.

Start and verify

cd /mnt/c/Cloud-Team/04_Learning_and_Reference/Training/CKS
cat lab/lesson-38-effective-args.txt
cp lab/lesson-38-kubelet-config.yaml /tmp/lesson-38-kubelet.yaml
nano /tmp/lesson-38-kubelet.yaml
bash lab/lesson-38-verify.sh /tmp/lesson-38-kubelet.yaml

Completion means five PASS lines. Send only that output.

Exam-speed inspection

docker exec cks-lab-worker ps -ef | grep '[k]ubelet'
docker exec cks-lab-worker sed -n '1,120p' /var/lib/kubelet/config.yaml

Use these after the task to compare the fixture with the real disposable worker. Do not modify the live worker configuration for this drill.