CIS Benchmark: Harden the Kubelet and etcd

Fix all issues via configuration and restart the affected components to ensure the new settings take effect. Fix all of the following violations that were found against the kubelet: The cluster uses…

Check live lab access → All CKS tasks

Live lab access

This task description is public. Live practice requires full access unless this is the selected free weekly task. See this week's free task.

Create an account to continue →

Read this week's free task →

On a phone? Read the task and create your account here, then sign in on a desktop or laptop for the terminal lab. Nothing starts until you choose Start.

The task

Context

You must resolve issues that a CIS Benchmark tool found for the kubeadm provisioned cluster.

Task

Fix all issues via configuration and restart the affected components to ensure the new settings take effect.

Fix all of the following violations that were found against the kubelet:

The cluster uses the Docker Engine as its container runtime. If needed, use the docker command to troubleshoot running containers.

Ensure that the anonymous-auth argument is set to false - FAIL
Ensure that the --authorization-mode argument is not set to AlwaysAllow - FAIL

> Use Webhook authentication/authorization where possible.

Fix all of the following violations that were found against etcd:

Ensure that the --client-cert-auth argument is set to true - FAIL

*Lab note: this practice node runs containerd rather than the Docker Engine, so use crictl (or kubectl) where you would use docker.*

*Lab note: after restarting the kubelet the node may take up to 60 seconds to return to Ready.*

Exam

CKS

Domain

Cluster Setup

Grading

Programmatic · partial credit

Reference

Kubernetes docs ↗

What this tests

Lock down network access, the kubelet, API authentication, and ingress TLS, and run CIS benchmark checks. On the CKS exam, Cluster Setup tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.

Practice it for real

The public description lets you study the task before signing up. Full access includes this live lab; the selected Task of the Week is free with an account. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). You can open the solution while practising, then retry and use the failed checks to improve your score.

Check live lab access → CKS overview