CKS-Lessons/learning-records/0012-kubelet-effective-configuration.md

Kubelet configuration and effective flags

The learner reconciled an insecure KubeletConfiguration with approved effective flags, independently setting anonymous authentication off, webhook authentication and authorization on, the read-only port to zero, and certificate rotation on. Future CIS practice can now combine configuration-file review with process-argument verification.

Evidence

lab/lesson-38-verify.sh /tmp/lesson-38-kubelet.yaml reported all five controls as PASS on 2026-08-27.