28 lines
1.6 KiB
HTML
28 lines
1.6 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<title>CKS-006 · Kubelet Authorization</title><link rel="stylesheet" href="../assets/course.css"></head><body><main class="page">
|
|
<header class="hero"><p class="eyebrow">CKS mastery journey · CIS final transfer</p><h1>Correct kubelet authorization</h1>
|
|
<p class="deck">Find one insecure field in a complete configuration and perform the full remediation safely.</p><div class="meta"><span class="pill">CKS-006</span><span class="pill">4 minutes</span></div></header>
|
|
<div class="layout"><section class="card"><h2>Complete exercise file</h2><p><code>/var/lib/kubelet/config.yaml</code> on <code>node03</code>:</p>
|
|
<pre><code>apiVersion: kubelet.config.k8s.io/v1beta1
|
|
kind: KubeletConfiguration
|
|
address: 0.0.0.0
|
|
port: 10250
|
|
readOnlyPort: 0
|
|
authentication:
|
|
anonymous:
|
|
enabled: false
|
|
webhook:
|
|
enabled: true
|
|
x509:
|
|
clientCAFile: /etc/kubernetes/pki/ca.crt
|
|
authorization:
|
|
mode: AlwaysAllow
|
|
clusterDNS:
|
|
- 10.96.0.10
|
|
clusterDomain: cluster.local
|
|
rotateCertificates: true
|
|
serverTLSBootstrap: true
|
|
staticPodPath: /etc/kubernetes/manifests</code></pre>
|
|
<p>Back up outside the directory, set authorization to <code>Webhook</code>, restart/check kubelet, rerun node check <code>4.2.2</code>, then verify <code>node03</code> is Ready from the original host.</p></section>
|
|
<aside class="rail card"><p class="eyebrow">Fresh attempt</p><h2>Four minutes</h2><p>Commands and corrected YAML only.</p><a class="button" href="../ANSWER.md">Open answer file</a><a class="button" href="../dashboard.html">Quest dashboard</a></aside></div></main></body></html>
|