CKS mastery journey · 1.2 CIS benchmark

Repair one API-server failure

Make a minimal static-Pod correction, recover the control plane, and prove the targeted CIS check passes.

CKS-0036 minutesFocused task

Task

[FAIL] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow

On controlplane, edit /etc/kubernetes/manifests/kube-apiserver.yaml.

The current line is:

- --authorization-mode=AlwaysAllow,RBAC

Back up the manifest. Change only what is necessary so the modes are exactly Node,RBAC. Verify API-server recovery and rerun check 1.2.7.