74 lines
5.0 KiB
HTML
74 lines
5.0 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width,initial-scale=1">
|
|
<title>Lesson 36: kube-bench CIS triage</title>
|
|
<link rel="stylesheet" href="../assets/course.css">
|
|
</head>
|
|
<body>
|
|
<main>
|
|
<p class="eyebrow">Lesson 0036 · 35 minutes · Tool drill · Cluster Setup</p>
|
|
<h1>Triage kube-bench findings without obeying the scanner blindly</h1>
|
|
<p class="lede">A scanner accelerates inspection; it does not replace component knowledge. Extract non-passing checks, verify them against configuration, identify uncovered components, and prioritize fixes by impact.</p>
|
|
|
|
<h2>Environment note</h2>
|
|
<p>The current Windows shell has no Docker, WSL, Kubernetes CLI, or Linux node access. Use the provided kube-bench JSON report for this training attempt. Hero remains unavailable until you rerun kube-bench on a Linux control-plane and worker node.</p>
|
|
|
|
<h2>Task: 25 minutes</h2>
|
|
<p>Analyze these files without modifying them:</p>
|
|
<ul>
|
|
<li><code>lab/lesson-36-kube-bench.json</code></li>
|
|
<li><code>lab/lesson-35-kube-apiserver-insecure.yaml</code></li>
|
|
<li><code>lab/lesson-36-etcd.yaml</code></li>
|
|
<li><code>lab/lesson-28-kubelet-review.yaml</code></li>
|
|
<li><code>lab/lesson-36-coredns.yaml</code></li>
|
|
</ul>
|
|
<p>Create <code>lab/lesson-36-answer.md</code> containing:</p>
|
|
<ol>
|
|
<li>The exact PowerShell command used to extract every non-PASS result from the JSON.</li>
|
|
<li>A table for all seven FAIL results and the one WARN result: check ID, component, status, scanner evidence, configuration evidence, verdict, and precise remediation.</li>
|
|
<li>Your first three remediations in operational priority order, with one sentence of justification each.</li>
|
|
<li>At least four security findings from the CoreDNS Deployment that kube-bench did not report.</li>
|
|
<li>One paragraph explaining why WARN does not mean FAIL, why PASS is not universal proof, and why CoreDNS requires manual review here.</li>
|
|
<li>The exact Linux commands you would use to install pinned kube-bench v0.16.0, verify its checksum, run control-plane/etcd/node/policies targets as root, save JSON, and make CI return a nonzero code when checks fail.</li>
|
|
</ol>
|
|
|
|
<div class="callout"><strong>Tool reflex:</strong> kube-bench has PASS, FAIL, WARN, and INFO states. A WARN commonly needs manual attention. A failed check can also reflect an execution or detection problem, so compare <code>actual_value</code> and <code>reason</code> with effective configuration before changing a node.</div>
|
|
|
|
<h2>PowerShell starting shape</h2>
|
|
<pre><code>$report = Get-Content .\lab\lesson-36-kube-bench.json -Raw | ConvertFrom-Json
|
|
$report.Controls.tests.results |
|
|
Where-Object status -ne 'PASS' |
|
|
Select-Object test_number, status, test_desc, actual_value, reason</code></pre>
|
|
|
|
<h2>Linux Hero rerun shape</h2>
|
|
<pre><code># Run on a Linux node with access to component processes and files.
|
|
sudo kube-bench run --targets master,etcd,node,policies \
|
|
--json --outputfile kube-bench.json --exit-code 42</code></pre>
|
|
<p>You must determine and record the complete pinned installation and checksum-verification commands yourself.</p>
|
|
|
|
<h2>Retrieval check</h2>
|
|
<div class="quiz">
|
|
<h3>Question</h3>
|
|
<p>kube-bench reports WARN for a manual check. What should you do?</p>
|
|
<label><input type="radio" name="q" value="verify">Inspect the effective configuration and record a manual verdict.</label>
|
|
<label><input type="radio" name="q" value="fail">Treat the warning as a proven configuration failure immediately.</label>
|
|
<label><input type="radio" name="q" value="ignore">Ignore the warning because only automated checks matter.</label>
|
|
<button onclick="check()">Check answer</button>
|
|
<p id="feedback" class="feedback" aria-live="polite"></p>
|
|
</div>
|
|
|
|
<h2>Documentation targets</h2>
|
|
<p>Use the official <a href="https://github.com/aquasecurity/kube-bench">kube-bench repository</a>, its <a href="https://github.com/aquasecurity/kube-bench/blob/main/docs/installation.md">installation guide</a>, and the applicable CIS benchmark guidance after your first analysis.</p>
|
|
|
|
<h2>What to send me</h2>
|
|
<p>Save the Markdown answer and say <em>check</em>. I will list every issue and correct one per round. This attempt can advance CS-02 training, but the Hero tool gate requires a later real-node run.</p>
|
|
<footer>Previous: <a href="0035-apiserver-audit-hard-mode.html">API server and audit hard mode</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer>
|
|
</main>
|
|
<script>
|
|
function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='verify'){f.textContent='Correct. WARN requires a manual, evidence-based verdict.';f.className='feedback good';}else{f.textContent='Not quite. The scanner has not proved either compliance or failure.';f.className='feedback bad';}}
|
|
</script>
|
|
</body>
|
|
</html>
|