CKS_FINALE

submissions/CKS-005-completed.md

@@ -0,0 +1,51 @@
+# CKS-005 — Close the kubelet read-only port
+
+Domain: **1.2 CIS benchmark review**  
+Target time: **4 minutes**  
+Score: **Section B only**
+
+## Task
+
+On `node02`, kube-bench reports that the kubelet read-only port is enabled. The complete exercise file `/var/lib/kubelet/config.yaml` is:
+
+```yaml
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+address: 0.0.0.0
+port: 10250
+readOnlyPort: 10255
+authentication:
+  anonymous:
+    enabled: false
+  webhook:
+    enabled: true
+  x509:
+    clientCAFile: /etc/kubernetes/pki/ca.crt
+authorization:
+  mode: Webhook
+clusterDNS:
+- 10.96.0.10
+clusterDomain: cluster.local
+rotateCertificates: true
+serverTLSBootstrap: true
+staticPodPath: /etc/kubernetes/manifests
+```
+
+Back up the file outside its directory, disable the read-only port, restart kubelet, confirm TCP `10255` is no longer listening, rerun only check `4.2.4` on the node, then verify `node02` is `Ready` from the original host.
+
+## Section B — scored answer
+
+```bash
+ssh node02
+cp /var/lib/kubelet/config.yaml ~/config.yaml-$(date +%Y-%m-%d)
+nano /var/lib/kubelet/config.yaml
+readOnlyPort: 0
+systemctl restart kubelet
+systemctl status kubelet
+ss -tunlp | grep -i 10255
+kube-bench run --targets node --check 4.2.4
+exit
+k get nodes
+```
+
+When ready, say: **Grade CKS-005**.