44 lines
959 B
Markdown
44 lines
959 B
Markdown
# CKS-004 — Repair one kubelet CIS failure
|
|
|
|
Domain: **1.2 CIS benchmark review**
|
|
Target time: **5 minutes**
|
|
Score: **Section B only**
|
|
|
|
## Task
|
|
|
|
On worker `node01`, kube-bench reports:
|
|
|
|
```text
|
|
[FAIL] 4.2.1 Ensure that the --anonymous-auth argument is set to false
|
|
```
|
|
|
|
`/var/lib/kubelet/config.yaml` currently contains:
|
|
|
|
```yaml
|
|
authentication:
|
|
anonymous:
|
|
enabled: true
|
|
```
|
|
|
|
Back up the file outside its directory, correct only this setting, restart the appropriate service, verify `node01` returns to `Ready`, and rerun only check `4.2.1` for the node target.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
ssh node01
|
|
cp /var/lib/kubelet/config.yaml ~/config.yaml.bkp-$(date +%Y-%m-%d)
|
|
nano /var/lib/kubelet/config.yaml
|
|
authentication:
|
|
anonymous:
|
|
enabled: false
|
|
systemctl restart kubelet
|
|
systemctl status kubelet
|
|
journalctl -xeu kubelet
|
|
kube-bench run --targets node --check 4.2.1
|
|
exit
|
|
k get node node01
|
|
|
|
```
|
|
|
|
When ready, say: **Grade CKS-004**.
|