CKS_FINALE

lessons/0003-cis-apiserver-authorization.html

@@ -0,0 +1,34 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>CKS-003 · CIS API Server Repair</title>
+  <link rel="stylesheet" href="../assets/course.css">
+</head>
+<body>
+  <main class="page">
+    <header class="hero">
+      <p class="eyebrow">CKS mastery journey · 1.2 CIS benchmark</p>
+      <h1>Repair one API-server failure</h1>
+      <p class="deck">Make a minimal static-Pod correction, recover the control plane, and prove the targeted CIS check passes.</p>
+      <div class="meta"><span class="pill">CKS-003</span><span class="pill">6 minutes</span><span class="pill">Focused task</span></div>
+    </header>
+    <div class="layout">
+      <section class="card">
+        <h2>Task</h2>
+        <pre><code>[FAIL] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow</code></pre>
+        <p>On <code>controlplane</code>, edit <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code>.</p>
+        <p>The current line is:</p>
+        <pre><code>- --authorization-mode=AlwaysAllow,RBAC</code></pre>
+        <p>Back up the manifest. Change only what is necessary so the modes are exactly <code>Node,RBAC</code>. Verify API-server recovery and rerun check <code>1.2.7</code>.</p>
+      </section>
+      <aside class="rail card">
+        <p class="eyebrow">Answer</p><h2>Keep it short</h2>
+        <p>Submit only the commands and corrected manifest line.</p>
+        <a class="button" href="../ANSWER.md">Open answer file</a>
+      </aside>
+    </div>
+    <footer>CKS Mastery Journey · Question 003</footer>
+  </main>
+</body>
+</html>