CKS_FINALE

lessons/0005-cis-kubelet-readonly-port.html

@@ -0,0 +1,29 @@
+<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>CKS-005 · Close Kubelet Read-Only Port</title><link rel="stylesheet" href="../assets/course.css"></head>
+<body><main class="page"><header class="hero"><p class="eyebrow">CKS mastery journey · Final CIS transfer</p>
+<h1>Close one unsafe port</h1><p class="deck">A four-minute kubelet hardening task.</p>
+<div class="meta"><span class="pill">CKS-005</span><span class="pill">4 minutes</span></div></header>
+<div class="layout"><section class="card"><h2>Task</h2><p>On <code>node02</code>, locate and disable the insecure read-only port in this complete exercise file, <code>/var/lib/kubelet/config.yaml</code>:</p>
+<pre><code>apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+address: 0.0.0.0
+port: 10250
+readOnlyPort: 10255
+authentication:
+  anonymous:
+    enabled: false
+  webhook:
+    enabled: true
+  x509:
+    clientCAFile: /etc/kubernetes/pki/ca.crt
+authorization:
+  mode: Webhook
+clusterDNS:
+- 10.96.0.10
+clusterDomain: cluster.local
+rotateCertificates: true
+serverTLSBootstrap: true
+staticPodPath: /etc/kubernetes/manifests</code></pre>
+<p>Back up first, restart kubelet, prove TCP 10255 is not listening, rerun only CIS check <code>4.2.4</code> on the node, and verify <code>node02</code> is <code>Ready</code> from the original host.</p></section>
+<aside class="rail card"><p class="eyebrow">Fresh attempt</p><h2>Four minutes</h2><p>Submit commands and corrected YAML only.</p><a class="button" href="../ANSWER.md">Open answer file</a></aside></div></main></body></html>