Skip to content
CKSCluster SetupTwo nodesMedium

Kubelet CIS hardening on a worker

Scenario cks-set-003 · about 8 minutes · 8 points · 6 grader checks

A worker's kubelet accepts anonymous, unauthorized requests and exposes the read-only port; harden its configuration in place.

  • kubelet
  • cis-benchmark
  • authentication
  • authorization
  • node

What you will practise

  • Read and edit the KubeletConfiguration file
  • Disable anonymous kubelet authentication and use Webhook authorization
  • Close the kubelet read-only port and confirm the running config

Start this lab

With the CLI installed and signed in, this command provisions a two nodes cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-set-003

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

A CIS benchmark review of worker node "exam-w1" reported that its kubelet accepts unauthenticated requests: anonymous authentication is enabled, every request is authorized, and the unauthenticated read-only port 10255 is open. Fix the kubelet on exam-w1 (configuration file /var/lib/kubelet/config.yaml): - anonymous authentication disabled; - authorization mode Webhook; - read-only port disabled. The running kubelet must use the fixed configuration and exam-w1 must be Ready. Do not recreate or rejoin the node.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Cluster Setup
Difficulty
Medium
Cluster topology
Two nodes
Cluster features
None beyond the base cluster
Recommended time
8 minutes
Points
8
Grader checks
6
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 6 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Cluster Setup labs

CKSCluster SetupMedium

NetworkPolicy: default deny both directions with DNS

Lock a namespace down with a default-deny ingress and egress policy, keep cluster DNS working and open exactly one client-to-server path.

Single node · ~9 min · 10 points

  • networkpolicy
  • default-deny
  • egress
  • dns
  • cluster-setup

goldenkube start cks-set-001

CKSCluster SetupMedium

Block the cloud metadata endpoint with an egress policy

Protect node metadata by blocking pod egress to 169.254.169.254 while keeping in-cluster traffic and other egress open.

Single node · ~6 min · 7 points

  • networkpolicy
  • egress
  • ipblock
  • metadata
  • cluster-setup

goldenkube start cks-set-002

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.