CKS_FINALE

submissions/CKS-003-completed.md

@@ -0,0 +1,43 @@
+# CKS-003 — Repair a CIS API-server failure
+
+Domain: **1.2 CIS benchmark review**  
+Target time: **6 minutes**  
+Score: **Section B only**
+
+## Task
+
+On host `controlplane`, `kube-bench` reports:
+
+```text
+[FAIL] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow
+```
+
+The kube-apiserver is a static Pod defined at:
+
+```text
+/etc/kubernetes/manifests/kube-apiserver.yaml
+```
+
+Its current command contains:
+
+```yaml
+- --authorization-mode=AlwaysAllow,RBAC
+```
+
+Change only what is necessary so authorization modes are exactly `Node,RBAC`. Back up the manifest first. Then verify that the API server recovers and check `1.2.7` passes.
+
+## Section B — scored answer
+
+Write the commands you would execute and the final corrected manifest line:
+
+```bash
+cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/kube-apiserver.yaml.bkp
+vi /etc/kubernetes/manifests/kube-apiserver.yaml
+- --authorization-mode=Node,RBAC
+crictl ps -a | grep -i apiserver
+k get pods -n kube-system
+ps -aux | grep -i apiserver
+kube-bench run --targets master --check 1.2.7
+```
+
+When ready, say: **Grade CKS-003**.