cks-final/submissions/CKS-006-completed.md

CKS-006 — Correct kubelet authorization

Domain: 1.2 CIS benchmark review
Target time: 4 minutes
Score: Section B only

Task

On node03, kube-bench reports that kubelet authorization is not set to Webhook. The complete exercise file /var/lib/kubelet/config.yaml is:

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0
port: 10250
readOnlyPort: 0
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: AlwaysAllow
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
rotateCertificates: true
serverTLSBootstrap: true
staticPodPath: /etc/kubernetes/manifests

Back up the file outside its directory, correct only the insecure setting, restart and check kubelet, rerun only check 4.2.2 on the node, then verify node03 is Ready from the original host.

Section B — scored answer

ssh node03
cp /var/lib/kubelet/config.yaml ~/config.yaml-$(date +%Y-%m-%d)
nano /var/lib/kubelet/config.yaml

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: 0.0.0.0
port: 10250
readOnlyPort: 0
authentication:
  anonymous:
    enabled: false
  webhook:
    enabled: true
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
rotateCertificates: true
serverTLSBootstrap: true
staticPodPath: /etc/kubernetes/manifests

systemctl restart kubelet
systemctl status kubelet
kube-bench run --targets node --check 4.2.2
exit
k get nodes

When ready, say: Grade CKS-006.