78 lines
1.6 KiB
Markdown
78 lines
1.6 KiB
Markdown
# CKS-006 — Correct kubelet authorization
|
|
|
|
Domain: **1.2 CIS benchmark review**
|
|
Target time: **4 minutes**
|
|
Score: **Section B only**
|
|
|
|
## Task
|
|
|
|
On `node03`, kube-bench reports that kubelet authorization is not set to `Webhook`. The complete exercise file `/var/lib/kubelet/config.yaml` is:
|
|
|
|
```yaml
|
|
apiVersion: kubelet.config.k8s.io/v1beta1
|
|
kind: KubeletConfiguration
|
|
address: 0.0.0.0
|
|
port: 10250
|
|
readOnlyPort: 0
|
|
authentication:
|
|
anonymous:
|
|
enabled: false
|
|
webhook:
|
|
enabled: true
|
|
x509:
|
|
clientCAFile: /etc/kubernetes/pki/ca.crt
|
|
authorization:
|
|
mode: AlwaysAllow
|
|
clusterDNS:
|
|
- 10.96.0.10
|
|
clusterDomain: cluster.local
|
|
rotateCertificates: true
|
|
serverTLSBootstrap: true
|
|
staticPodPath: /etc/kubernetes/manifests
|
|
```
|
|
|
|
Back up the file outside its directory, correct only the insecure setting, restart and check kubelet, rerun only check `4.2.2` on the node, then verify `node03` is `Ready` from the original host.
|
|
|
|
## Section B — scored answer
|
|
|
|
```bash
|
|
ssh node03
|
|
cp /var/lib/kubelet/config.yaml ~/config.yaml-$(date +%Y-%m-%d)
|
|
nano /var/lib/kubelet/config.yaml
|
|
```
|
|
|
|
```yaml
|
|
apiVersion: kubelet.config.k8s.io/v1beta1
|
|
kind: KubeletConfiguration
|
|
address: 0.0.0.0
|
|
port: 10250
|
|
readOnlyPort: 0
|
|
authentication:
|
|
anonymous:
|
|
enabled: false
|
|
webhook:
|
|
enabled: true
|
|
x509:
|
|
clientCAFile: /etc/kubernetes/pki/ca.crt
|
|
authorization:
|
|
mode: Webhook
|
|
clusterDNS:
|
|
- 10.96.0.10
|
|
clusterDomain: cluster.local
|
|
rotateCertificates: true
|
|
serverTLSBootstrap: true
|
|
staticPodPath: /etc/kubernetes/manifests
|
|
|
|
```
|
|
```bash
|
|
systemctl restart kubelet
|
|
systemctl status kubelet
|
|
kube-bench run --targets node --check 4.2.2
|
|
exit
|
|
k get nodes
|
|
```
|
|
|
|
|
|
|
|
When ready, say: **Grade CKS-006**.
|