5 lines
2.2 KiB
HTML
5 lines
2.2 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 37: etcd static-manifest hardening</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0037 · 15 minutes · Linux performance lab · Cluster Setup</p><h1>Harden etcd without breaking membership</h1><p class="lede">This is a focused CIS remediation drill. It deliberately removes the cluster-entry and package-installation friction from the previous attempt.</p><div class="callout"><strong>Scope discipline:</strong> change only the insecure transport, authentication, and metrics flags. Preserve identity, data, listen/advertise peer addresses, initial cluster membership, certificates, mounts, and image.</div><h2>Task</h2><p>On the Linux lab shell, create <code>/tmp/lesson-37-etcd.yaml</code> from <code>lab/lesson-37-etcd-insecure.yaml</code>. Make it pass the supplied verifier.</p><ul><li>Require client and peer client certificates.</li><li>Disable automatic TLS for both client and peer traffic.</li><li>Keep the existing explicit CA, certificate, and key paths.</li><li>Ensure client traffic uses HTTPS only.</li><li>Bind the metrics listener only to <code>127.0.0.1:2381</code>.</li></ul><p>Do not edit the original fixture or verifier. Do not use <code>kubectl apply</code>; this is a static-manifest file exercise.</p><h2>Start and prove it</h2><pre><code>cd /mnt/c/Cloud-Team/04_Learning_and_Reference/Training/CKS
|
|
cp lab/lesson-37-etcd-insecure.yaml /tmp/lesson-37-etcd.yaml
|
|
nano /tmp/lesson-37-etcd.yaml
|
|
bash lab/lesson-37-verify.sh /tmp/lesson-37-etcd.yaml</code></pre><p>Completion means every line reports <code>PASS</code>. Send that output only.</p><h2>Documentation</h2><p>Use the official <a href="https://etcd.io/docs/v3.6/op-guide/security/">etcd transport security guide</a> if needed. The CKS objective is preserving the required configuration while closing only the proven exposure.</p><footer>Previous: <a href="0036-kube-bench-cis-remediation.html">kube-bench CIS remediation</a> · Tracker: <a href="../CKS-MASTERY-CHECKLIST.md">CKS Mastery Checklist</a></footer></main></body></html>
|