52 lines
1.3 KiB
Markdown
52 lines
1.3 KiB
Markdown
# CKS-005 — Close the kubelet read-only port
|
|
|
|
Domain: **1.2 CIS benchmark review**
|
|
Target time: **4 minutes**
|
|
Score: **Section B only**
|
|
|
|
## Task
|
|
|
|
On `node02`, kube-bench reports that the kubelet read-only port is enabled. The complete exercise file `/var/lib/kubelet/config.yaml` is:
|
|
|
|
```yaml
|
|
apiVersion: kubelet.config.k8s.io/v1beta1
|
|
kind: KubeletConfiguration
|
|
address: 0.0.0.0
|
|
port: 10250
|
|
readOnlyPort: 10255
|
|
authentication:
|
|
anonymous:
|
|
enabled: false
|
|
webhook:
|
|
enabled: true
|
|
x509:
|
|
clientCAFile: /etc/kubernetes/pki/ca.crt
|
|
authorization:
|
|
mode: Webhook
|
|
clusterDNS:
|
|
- 10.96.0.10
|
|
clusterDomain: cluster.local
|
|
rotateCertificates: true
|
|
serverTLSBootstrap: true
|
|
staticPodPath: /etc/kubernetes/manifests
|
|
```
|
|
|
|
Back up the file outside its directory, disable the read-only port, restart kubelet, confirm TCP `10255` is no longer listening, rerun only check `4.2.4` on the node, then verify `node02` is `Ready` from the original host.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
ssh node02
|
|
cp /var/lib/kubelet/config.yaml ~/config.yaml-$(date +%Y-%m-%d)
|
|
nano /var/lib/kubelet/config.yaml
|
|
readOnlyPort: 0
|
|
systemctl restart kubelet
|
|
systemctl status kubelet
|
|
ss -tunlp | grep -i 10255
|
|
kube-bench run --targets node --check 4.2.4
|
|
exit
|
|
k get nodes
|
|
```
|
|
|
|
When ready, say: **Grade CKS-005**.
|