CKS mastery journey · CIS final transfer

Correct kubelet authorization

Find one insecure field in a complete configuration and perform the full remediation safely.

CKS-0064 minutes

Complete exercise file

/var/lib/kubelet/config.yaml on node03:

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0
port: 10250
readOnlyPort: 0
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: AlwaysAllow
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
rotateCertificates: true
serverTLSBootstrap: true
staticPodPath: /etc/kubernetes/manifests

Back up outside the directory, set authorization to Webhook, restart/check kubelet, rerun node check 4.2.2, then verify node03 is Ready from the original host.