# CKS-007 — Repair control-plane manifest permissions

Domain: **1.2 CIS benchmark review**  
Target time: **3 minutes**  
Reward: **100 XP clean win**

## Task

On `controlplane`, kube-bench check `1.1.3` fails because:

```text
/etc/kubernetes/manifests/kube-controller-manager.yaml  mode=0644 owner=root group=root
```

Back up the file outside the manifest directory, make its permissions `0600` without changing ownership, verify mode and ownership, then rerun only check `1.1.3` for the master target.

## Section B — scored answer

```bash
cp /etc/kubernetes/manifests/kube-controller-manager.yaml ~/kube-controller-manager.yaml-$(date +%Y-%m-%d)
chmod 0600 /etc/kubernetes/manifests/kube-controller-manager.yaml 
ls -la /etc/kubernetes/manifests/kube-controller-manager.yaml 
kube-bench run --targets master --check 1.1.3
```

When ready, say **Grade CKS-007**.