cks-final/submissions/CKS-007-completed.md

CKS-007 — Repair control-plane manifest permissions

Domain: 1.2 CIS benchmark review
Target time: 3 minutes
Reward: 100 XP clean win

Task

On controlplane, kube-bench check 1.1.3 fails because:

/etc/kubernetes/manifests/kube-controller-manager.yaml  mode=0644 owner=root group=root

Back up the file outside the manifest directory, make its permissions 0600 without changing ownership, verify mode and ownership, then rerun only check 1.1.3 for the master target.

Section B — scored answer

cp /etc/kubernetes/manifests/kube-controller-manager.yaml ~/kube-controller-manager.yaml-$(date +%Y-%m-%d)
chmod 0600 /etc/kubernetes/manifests/kube-controller-manager.yaml 
ls -la /etc/kubernetes/manifests/kube-controller-manager.yaml 
kube-bench run --targets master --check 1.1.3

When ready, say Grade CKS-007.