# CKS-003 — Repair a CIS API-server failure

Domain: **1.2 CIS benchmark review**  
Target time: **6 minutes**  
Score: **Section B only**

## Task

On host `controlplane`, `kube-bench` reports:

```text
[FAIL] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow
```

The kube-apiserver is a static Pod defined at:

```text
/etc/kubernetes/manifests/kube-apiserver.yaml
```

Its current command contains:

```yaml
- --authorization-mode=AlwaysAllow,RBAC
```

Change only what is necessary so authorization modes are exactly `Node,RBAC`. Back up the manifest first. Then verify that the API server recovers and check `1.2.7` passes.

## Section B — scored answer

Write the commands you would execute and the final corrected manifest line:

```bash
cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/kube-apiserver.yaml.bkp
vi /etc/kubernetes/manifests/kube-apiserver.yaml
- --authorization-mode=Node,RBAC
crictl ps -a | grep -i apiserver
k get pods -n kube-system
ps -aux | grep -i apiserver
kube-bench run --targets master --check 1.2.7
```

When ready, say: **Grade CKS-003**.