3 lines
3.6 KiB
HTML
3 lines
3.6 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 15: Kubelet endpoint hardening</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0015 · 35 minutes · Cluster Setup and System Hardening</p><h1>Remove anonymous access to the kubelet</h1><p class="lede">The kubelet is a node-level control point. An exposed read-only or anonymously accessible endpoint can reveal workload and node information, so secure its authentication and authorization before investigating higher-level policy.</p><div class="callout"><strong>Exam reflex:</strong> distinguish kubelet authentication from authorization. Disabling anonymous access does not make authorization safe by itself; both controls must be configured.</div><h2>Timed task: 25 minutes</h2><p>Review <code>lab/lesson-15-kubelet-config-insecure.yaml</code>. Create a complete replacement configuration as <code>lab/lesson-15-kubelet-config-answer.yaml</code>.</p><p>Preserve the API version and kind. Your completed configuration must:</p><ul><li>Reject unauthenticated kubelet requests.</li><li>Use webhook authentication and webhook authorization for authenticated API requests.</li><li>Disable the legacy read-only kubelet port.</li><li>Protect kernel defaults.</li><li>Enable kubelet client-certificate rotation.</li></ul><p>Do not add unrelated fields or change API versions. This is a node configuration artifact; do not run <code>kubectl apply</code> against it.</p><h2>Verification</h2><pre><code>Get-Content .\lab\lesson-15-kubelet-config-answer.yaml
|
||
</code></pre><p>The completed configuration should leave nothing listening on TCP 10255. In a real cluster, deploy it through the node’s kubelet configuration-management path and restart the kubelet only under the approved maintenance procedure.</p><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>Why is setting <code>authorization.mode: Webhook</code> insufficient if <code>authentication.anonymous.enabled</code> remains true?</p><label><input type="radio" name="q" value="anonymous">Anonymous requests can still reach the kubelet and rely on whatever authorization is granted to the anonymous identity.</label><label><input type="radio" name="q" value="port">Webhook authorization automatically closes port 10255.</label><label><input type="radio" name="q" value="cert">Authorization automatically rotates client certificates.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official Kubernetes <a href="https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/">KubeletConfiguration API reference</a> and the kubelet authentication/authorization documentation.</p><h2>What to send me</h2><p>Paste the replacement configuration. I’ll check every required field, then explain how the settings combine to secure the endpoint.</p><footer>Previous: <a href="0014-kubernetes-audit-policy.html">Kubernetes audit policy</a> · CKS domains: Cluster Setup and System Hardening</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='anonymous'){f.textContent='Correct. Authentication decides whether and as whom the request enters; authorization then evaluates that identity.';f.className='feedback good';}else{f.textContent='Not quite. Authentication and authorization are separate controls; configure both.';f.className='feedback bad';}}</script></body></html>
|