CKS-Lessons/learning-records/0011-etcd-transport-and-metrics-hardening.md

etcd transport and metrics hardening

The learner independently remediated an etcd static manifest to require client and peer certificates, disable automatic TLS, eliminate HTTP client exposure, and bind metrics to loopback while preserving the existing CA and certificate paths. This establishes a reliable baseline for the next CIS drill: reconciling kubelet configuration with its effective process.

Evidence

lab/lesson-37-verify.sh /tmp/lesson-37-etcd.yaml reported every required control as PASS on 2026-08-27.