Lesson 0028 · 25 minutes · Cluster Setup

Review and harden a kubelet configuration

A kubelet runs on every node and exposes a sensitive management API. This exercise focuses on recognizing unsafe kubelet settings and producing a minimal secure configuration.

Timed task: 15 minutes

Read lab/lesson-28-kubelet-review.yaml. Create lab/lesson-28-answer.yaml from scratch. It must be a complete KubeletConfiguration that corrects every insecure setting present in the fixture.

Keep the same API version and kind. Do not add unrelated kubelet options.

Required security outcome

No anonymous kubelet authentication.
Webhook authentication enabled.
Webhook authorization selected.
The legacy read-only port disabled.
Kernel defaults protected.
Kubelet client certificates rotate.

Exam reflex: distinguish a Boolean switch from a mode. The kubelet authorization choice is a value under authorization.mode; disabling the old HTTP endpoint is done by assigning its port the disabling value.

Safe verification

kubectl apply --dry-run=client -f .\lab\lesson-28-answer.yaml

Do not apply this directly to a live node without following your distribution’s kubelet configuration and restart procedure.

Documentation target

Use the Kubernetes KubeletConfiguration API reference and the CIS Kubernetes Benchmark for your environment.

What to send me

Save the YAML, then say check. I’ll review only the first issue at a time.