CKS_FINALE

submissions/CKS-004-completed.md

@@ -0,0 +1,43 @@
+# CKS-004 — Repair one kubelet CIS failure
+
+Domain: **1.2 CIS benchmark review**  
+Target time: **5 minutes**  
+Score: **Section B only**
+
+## Task
+
+On worker `node01`, kube-bench reports:
+
+```text
+[FAIL] 4.2.1 Ensure that the --anonymous-auth argument is set to false
+```
+
+`/var/lib/kubelet/config.yaml` currently contains:
+
+```yaml
+authentication:
+  anonymous:
+    enabled: true
+```
+
+Back up the file outside its directory, correct only this setting, restart the appropriate service, verify `node01` returns to `Ready`, and rerun only check `4.2.1` for the node target.
+
+## Section B — scored answer
+
+```bash
+ssh node01
+cp /var/lib/kubelet/config.yaml ~/config.yaml.bkp-$(date +%Y-%m-%d)
+nano /var/lib/kubelet/config.yaml
+authentication:
+  anonymous:
+    enabled: false
+systemctl restart kubelet
+systemctl status kubelet
+journalctl -xeu kubelet
+kube-bench run --targets node --check 4.2.1
+exit
+k get node node01
+
+```
+
+When ready, say: **Grade CKS-004**.