# CKS-004 — Repair one kubelet CIS failure

Domain: **1.2 CIS benchmark review**  
Target time: **5 minutes**  
Score: **Section B only**

## Task

On worker `node01`, kube-bench reports:

```text
[FAIL] 4.2.1 Ensure that the --anonymous-auth argument is set to false
```

`/var/lib/kubelet/config.yaml` currently contains:

```yaml
authentication:
  anonymous:
    enabled: true
```

Back up the file outside its directory, correct only this setting, restart the appropriate service, verify `node01` returns to `Ready`, and rerun only check `4.2.1` for the node target.

## Section B — scored answer

```bash
ssh node01
cp /var/lib/kubelet/config.yaml ~/config.yaml.bkp-$(date +%Y-%m-%d)
nano /var/lib/kubelet/config.yaml
authentication:
  anonymous:
    enabled: false
systemctl restart kubelet
systemctl status kubelet
journalctl -xeu kubelet
kube-bench run --targets node --check 4.2.1
exit
k get node node01

```

When ready, say: **Grade CKS-004**.