cks-final/submissions/CKS-003-completed.md

CKS-003 — Repair a CIS API-server failure

Domain: 1.2 CIS benchmark review
Target time: 6 minutes
Score: Section B only

Task

On host controlplane, kube-bench reports:

[FAIL] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow

The kube-apiserver is a static Pod defined at:

/etc/kubernetes/manifests/kube-apiserver.yaml

Its current command contains:

- --authorization-mode=AlwaysAllow,RBAC

Change only what is necessary so authorization modes are exactly Node,RBAC. Back up the manifest first. Then verify that the API server recovers and check 1.2.7 passes.

Section B — scored answer

Write the commands you would execute and the final corrected manifest line:

cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/kube-apiserver.yaml.bkp
vi /etc/kubernetes/manifests/kube-apiserver.yaml
- --authorization-mode=Node,RBAC
crictl ps -a | grep -i apiserver
k get pods -n kube-system
ps -aux | grep -i apiserver
kube-bench run --targets master --check 1.2.7

When ready, say: Grade CKS-003.