44 lines
1.1 KiB
Markdown
44 lines
1.1 KiB
Markdown
# CKS-003 — Repair a CIS API-server failure
|
|
|
|
Domain: **1.2 CIS benchmark review**
|
|
Target time: **6 minutes**
|
|
Score: **Section B only**
|
|
|
|
## Task
|
|
|
|
On host `controlplane`, `kube-bench` reports:
|
|
|
|
```text
|
|
[FAIL] 1.2.7 Ensure that the --authorization-mode argument is not set to AlwaysAllow
|
|
```
|
|
|
|
The kube-apiserver is a static Pod defined at:
|
|
|
|
```text
|
|
/etc/kubernetes/manifests/kube-apiserver.yaml
|
|
```
|
|
|
|
Its current command contains:
|
|
|
|
```yaml
|
|
- --authorization-mode=AlwaysAllow,RBAC
|
|
```
|
|
|
|
Change only what is necessary so authorization modes are exactly `Node,RBAC`. Back up the manifest first. Then verify that the API server recovers and check `1.2.7` passes.
|
|
|
|
## Section B — scored answer
|
|
|
|
Write the commands you would execute and the final corrected manifest line:
|
|
|
|
```bash
|
|
cp /etc/kubernetes/manifests/kube-apiserver.yaml ~/kube-apiserver.yaml.bkp
|
|
vi /etc/kubernetes/manifests/kube-apiserver.yaml
|
|
- --authorization-mode=Node,RBAC
|
|
crictl ps -a | grep -i apiserver
|
|
k get pods -n kube-system
|
|
ps -aux | grep -i apiserver
|
|
kube-bench run --targets master --check 1.2.7
|
|
```
|
|
|
|
When ready, say: **Grade CKS-003**.
|