Lesson 0036 · 25 minutes · Linux performance lab · Cluster Setup

Remediate kube-bench failures

Complete this task on disposable Linux hosts running a kubeadm-style Kubernetes v1.34 cluster with kube-bench v0.16.0. No written explanation is required.

Environment required: a disposable Kubernetes v1.34 lab with one control-plane host, one worker host, root access, kube-bench v0.16.0, and editable component configuration. Do not perform this training remediation on the learner's Kubernetes v1.36 production cluster: kube-bench v0.16.0 maps only through Kubernetes v1.34.

Task

Start on host controlplane. Become root. Do not change any setting not named below.

  1. Run kube-bench checks 1.2.1, 1.2.7, 2.2, and 2.3. Save the output to /root/lesson-36-controlplane-before.txt.
  2. Configure kube-apiserver with anonymous authentication disabled and authorization modes Node,RBAC.
  3. Configure etcd with client-certificate authentication enabled and automatic TLS disabled. Preserve its existing CA, certificate, key, peer, data, and cluster settings.
  4. Wait for kube-apiserver and etcd to become healthy.
  5. Rerun the same four checks and save output to /root/lesson-36-controlplane-after.txt. All four checks must report PASS.

Return to the base host, then connect directly to host worker. Become root.

  1. Run kube-bench checks 4.2.1, 4.2.2, and 4.2.3. Save output to /root/lesson-36-worker-before.txt.
  2. Configure kubelet so anonymous authentication is disabled, webhook authentication is enabled, and authorization mode is Webhook.
  3. Restart kubelet and verify the node returns to Ready.
  4. Rerun the same three checks and save output to /root/lesson-36-worker-after.txt. All three checks must report PASS.

Completion evidence

Send only these outputs:

# controlplane
grep -E '^\[(PASS|FAIL|WARN)\]' /root/lesson-36-controlplane-after.txt

# worker
grep -E '^\[(PASS|FAIL|WARN)\]' /root/lesson-36-worker-after.txt
systemctl is-active kubelet
kubectl get node worker

Do not submit an essay or remediation table. The result is graded from component state, saved scanner output, and node health.

Documentation

Use the installed kube-bench help, component configuration files, and official kube-bench documentation as needed.

What to send me

Send the four PASS groups, systemctl result, and worker-node status. I will list all detected issues and correct one per round.