cks-final/submissions/CKS-004-completed.md

CKS-004 — Repair one kubelet CIS failure

Domain: 1.2 CIS benchmark review
Target time: 5 minutes
Score: Section B only

Task

On worker node01, kube-bench reports:

[FAIL] 4.2.1 Ensure that the --anonymous-auth argument is set to false

/var/lib/kubelet/config.yaml currently contains:

authentication:
  anonymous:
    enabled: true

Back up the file outside its directory, correct only this setting, restart the appropriate service, verify node01 returns to Ready, and rerun only check 4.2.1 for the node target.

Section B — scored answer

ssh node01
cp /var/lib/kubelet/config.yaml ~/config.yaml.bkp-$(date +%Y-%m-%d)
nano /var/lib/kubelet/config.yaml
authentication:
  anonymous:
    enabled: false
systemctl restart kubelet
systemctl status kubelet
journalctl -xeu kubelet
kube-bench run --targets node --check 4.2.1
exit
k get node node01

When ready, say: Grade CKS-004.