58 lines
3.4 KiB
HTML
58 lines
3.4 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<title>Lesson 36: kube-bench CIS remediation</title>
|
|
<link rel="stylesheet" href="../assets/course.css">
|
|
</head>
|
|
<body>
|
|
<main>
|
|
<p class="eyebrow">Lesson 0036 · 25 minutes · Linux performance lab · Cluster Setup</p>
|
|
<h1>Remediate kube-bench failures</h1>
|
|
<p class="lede">Complete this task on disposable Linux hosts running a kubeadm-style Kubernetes v1.34 cluster with kube-bench v0.16.0. No written explanation is required.</p>
|
|
|
|
<div class="callout"><strong>Environment required:</strong> a disposable Kubernetes v1.34 lab with one control-plane host, one worker host, root access, kube-bench v0.16.0, and editable component configuration. Do not perform this training remediation on the learner's Kubernetes v1.36 production cluster: kube-bench v0.16.0 maps only through Kubernetes v1.34.</div>
|
|
|
|
<h2>Task</h2>
|
|
<p>Start on host <code>controlplane</code>. Become root. Do not change any setting not named below.</p>
|
|
|
|
<ol>
|
|
<li>Run kube-bench checks <code>1.2.1</code>, <code>1.2.7</code>, <code>2.2</code>, and <code>2.3</code>. Save the output to <code>/root/lesson-36-controlplane-before.txt</code>.</li>
|
|
<li>Configure kube-apiserver with anonymous authentication disabled and authorization modes <code>Node,RBAC</code>.</li>
|
|
<li>Configure etcd with client-certificate authentication enabled and automatic TLS disabled. Preserve its existing CA, certificate, key, peer, data, and cluster settings.</li>
|
|
<li>Wait for kube-apiserver and etcd to become healthy.</li>
|
|
<li>Rerun the same four checks and save output to <code>/root/lesson-36-controlplane-after.txt</code>. All four checks must report PASS.</li>
|
|
</ol>
|
|
|
|
<p>Return to the base host, then connect directly to host <code>worker</code>. Become root.</p>
|
|
|
|
<ol start="6">
|
|
<li>Run kube-bench checks <code>4.2.1</code>, <code>4.2.2</code>, and <code>4.2.3</code>. Save output to <code>/root/lesson-36-worker-before.txt</code>.</li>
|
|
<li>Configure kubelet so anonymous authentication is disabled, webhook authentication is enabled, and authorization mode is <code>Webhook</code>.</li>
|
|
<li>Restart kubelet and verify the node returns to <code>Ready</code>.</li>
|
|
<li>Rerun the same three checks and save output to <code>/root/lesson-36-worker-after.txt</code>. All three checks must report PASS.</li>
|
|
</ol>
|
|
|
|
<h2>Completion evidence</h2>
|
|
<p>Send only these outputs:</p>
|
|
<pre><code># controlplane
|
|
grep -E '^\[(PASS|FAIL|WARN)\]' /root/lesson-36-controlplane-after.txt
|
|
|
|
# worker
|
|
grep -E '^\[(PASS|FAIL|WARN)\]' /root/lesson-36-worker-after.txt
|
|
systemctl is-active kubelet
|
|
kubectl get node worker</code></pre>
|
|
|
|
<p>Do not submit an essay or remediation table. The result is graded from component state, saved scanner output, and node health.</p>
|
|
|
|
<h2>Documentation</h2>
|
|
<p>Use the installed kube-bench help, component configuration files, and official <a href="https://github.com/aquasecurity/kube-bench">kube-bench documentation</a> as needed.</p>
|
|
|
|
<h2>What to send me</h2>
|
|
<p>Send the four PASS groups, <code>systemctl</code> result, and worker-node status. I will list all detected issues and correct one per round.</p>
|
|
<footer>Previous: <a href="0035-apiserver-audit-hard-mode.html">API server and audit hard mode</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer>
|
|
</main>
|
|
</body>
|
|
</html>
|