CKS_FINALE

submissions/CKS-007-completed.md

@@ -0,0 +1,26 @@
+# CKS-007 — Repair control-plane manifest permissions
+
+Domain: **1.2 CIS benchmark review**  
+Target time: **3 minutes**  
+Reward: **100 XP clean win**
+
+## Task
+
+On `controlplane`, kube-bench check `1.1.3` fails because:
+
+```text
+/etc/kubernetes/manifests/kube-controller-manager.yaml  mode=0644 owner=root group=root
+```
+
+Back up the file outside the manifest directory, make its permissions `0600` without changing ownership, verify mode and ownership, then rerun only check `1.1.3` for the master target.
+
+## Section B — scored answer
+
+```bash
+cp /etc/kubernetes/manifests/kube-controller-manager.yaml ~/kube-controller-manager.yaml-$(date +%Y-%m-%d)
+chmod 0600 /etc/kubernetes/manifests/kube-controller-manager.yaml 
+ls -la /etc/kubernetes/manifests/kube-controller-manager.yaml 
+kube-bench run --targets master --check 1.1.3
+```
+
+When ready, say **Grade CKS-007**.