CKS_FINALE

submissions/CKS-006-completed.md

@@ -0,0 +1,77 @@
+# CKS-006 — Correct kubelet authorization
+
+Domain: **1.2 CIS benchmark review**  
+Target time: **4 minutes**  
+Score: **Section B only**
+
+## Task
+
+On `node03`, kube-bench reports that kubelet authorization is not set to `Webhook`. The complete exercise file `/var/lib/kubelet/config.yaml` is:
+
+```yaml
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+address: 0.0.0.0
+port: 10250
+readOnlyPort: 0
+authentication:
+  anonymous:
+    enabled: false
+  webhook:
+    enabled: true
+  x509:
+    clientCAFile: /etc/kubernetes/pki/ca.crt
+authorization:
+  mode: AlwaysAllow
+clusterDNS:
+- 10.96.0.10
+clusterDomain: cluster.local
+rotateCertificates: true
+serverTLSBootstrap: true
+staticPodPath: /etc/kubernetes/manifests
+```
+
+Back up the file outside its directory, correct only the insecure setting, restart and check kubelet, rerun only check `4.2.2` on the node, then verify `node03` is `Ready` from the original host.
+
+## Section B — scored answer
+
+```bash
+ssh node03
+cp /var/lib/kubelet/config.yaml ~/config.yaml-$(date +%Y-%m-%d)
+nano /var/lib/kubelet/config.yaml
+```
+
+```yaml
+apiVersion: kubelet.config.k8s.io/v1beta1
+kind: KubeletConfiguration
+address: 0.0.0.0
+port: 10250
+readOnlyPort: 0
+authentication:
+  anonymous:
+    enabled: false
+  webhook:
+    enabled: true
+  x509:
+    clientCAFile: /etc/kubernetes/pki/ca.crt
+authorization:
+  mode: Webhook
+clusterDNS:
+- 10.96.0.10
+clusterDomain: cluster.local
+rotateCertificates: true
+serverTLSBootstrap: true
+staticPodPath: /etc/kubernetes/manifests
+
+```
+```bash
+systemctl restart kubelet
+systemctl status kubelet
+kube-bench run --targets node --check 4.2.2
+exit
+k get nodes
+```
+
+
+
+When ready, say: **Grade CKS-006**.