27 lines
874 B
Markdown
27 lines
874 B
Markdown
# CKS-007 — Repair control-plane manifest permissions
|
|
|
|
Domain: **1.2 CIS benchmark review**
|
|
Target time: **3 minutes**
|
|
Reward: **100 XP clean win**
|
|
|
|
## Task
|
|
|
|
On `controlplane`, kube-bench check `1.1.3` fails because:
|
|
|
|
```text
|
|
/etc/kubernetes/manifests/kube-controller-manager.yaml mode=0644 owner=root group=root
|
|
```
|
|
|
|
Back up the file outside the manifest directory, make its permissions `0600` without changing ownership, verify mode and ownership, then rerun only check `1.1.3` for the master target.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
cp /etc/kubernetes/manifests/kube-controller-manager.yaml ~/kube-controller-manager.yaml-$(date +%Y-%m-%d)
|
|
chmod 0600 /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
ls -la /etc/kubernetes/manifests/kube-controller-manager.yaml
|
|
kube-bench run --targets master --check 1.1.3
|
|
```
|
|
|
|
When ready, say **Grade CKS-007**.
|