# CKS-005 — Close the kubelet read-only port

Domain: **1.2 CIS benchmark review**  
Target time: **4 minutes**  
Score: **Section B only**

## Task

On `node02`, kube-bench reports that the kubelet read-only port is enabled. The complete exercise file `/var/lib/kubelet/config.yaml` is:

```yaml
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0
port: 10250
readOnlyPort: 10255
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
rotateCertificates: true
serverTLSBootstrap: true
staticPodPath: /etc/kubernetes/manifests
```

Back up the file outside its directory, disable the read-only port, restart kubelet, confirm TCP `10255` is no longer listening, rerun only check `4.2.4` on the node, then verify `node02` is `Ready` from the original host.

## Section B — scored answer

```bash
ssh node02
cp /var/lib/kubelet/config.yaml ~/config.yaml-$(date +%Y-%m-%d)
nano /var/lib/kubelet/config.yaml
readOnlyPort: 0
systemctl restart kubelet
systemctl status kubelet
ss -tunlp | grep -i 10255
kube-bench run --targets node --check 4.2.4
exit
k get nodes
```

When ready, say: **Grade CKS-005**.