cks-final/submissions/CKS-005-completed.md

CKS-005 — Close the kubelet read-only port

Domain: 1.2 CIS benchmark review
Target time: 4 minutes
Score: Section B only

Task

On node02, kube-bench reports that the kubelet read-only port is enabled. The complete exercise file /var/lib/kubelet/config.yaml is:

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0
port: 10250
readOnlyPort: 10255
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
rotateCertificates: true
serverTLSBootstrap: true
staticPodPath: /etc/kubernetes/manifests

Back up the file outside its directory, disable the read-only port, restart kubelet, confirm TCP 10255 is no longer listening, rerun only check 4.2.4 on the node, then verify node02 is Ready from the original host.

Section B — scored answer

ssh node02
cp /var/lib/kubelet/config.yaml ~/config.yaml-$(date +%Y-%m-%d)
nano /var/lib/kubelet/config.yaml
readOnlyPort: 0
systemctl restart kubelet
systemctl status kubelet
ss -tunlp | grep -i 10255
kube-bench run --targets node --check 4.2.4
exit
k get nodes

When ready, say: Grade CKS-005.