2 lines
2.0 KiB
HTML
2 lines
2.0 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Lesson 28: Kubelet CIS review</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0028 · 25 minutes · Cluster Setup</p><h1>Review and harden a kubelet configuration</h1><p class="lede">A kubelet runs on every node and exposes a sensitive management API. This exercise focuses on recognizing unsafe kubelet settings and producing a minimal secure configuration.</p><h2>Timed task: 15 minutes</h2><p>Read <code>lab/lesson-28-kubelet-review.yaml</code>. Create <code>lab/lesson-28-answer.yaml</code> from scratch. It must be a complete <code>KubeletConfiguration</code> that corrects every insecure setting present in the fixture.</p><p>Keep the same API version and kind. Do not add unrelated kubelet options.</p><h2>Required security outcome</h2><ul><li>No anonymous kubelet authentication.</li><li>Webhook authentication enabled.</li><li>Webhook authorization selected.</li><li>The legacy read-only port disabled.</li><li>Kernel defaults protected.</li><li>Kubelet client certificates rotate.</li></ul><div class="callout"><strong>Exam reflex:</strong> distinguish a Boolean switch from a mode. The kubelet authorization choice is a value under <code>authorization.mode</code>; disabling the old HTTP endpoint is done by assigning its port the disabling value.</div><h2>Safe verification</h2><pre><code>kubectl apply --dry-run=client -f .\lab\lesson-28-answer.yaml</code></pre><p>Do not apply this directly to a live node without following your distribution’s kubelet configuration and restart procedure.</p><h2>Documentation target</h2><p>Use the Kubernetes <a href="https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/">KubeletConfiguration API reference</a> and the CIS Kubernetes Benchmark for your environment.</p><h2>What to send me</h2><p>Save the YAML, then say <em>check</em>. I’ll review only the first issue at a time.</p></main></body></html>
|