CKSKubernetes 1.35

Exercises

Exercise: kube-bench, then fix two controls

updated 2026-10-22 by seed

Host: controlplane (root) · Time: 10 min · Domain: Cluster Setup

Task

  • Run kube-bench against the control plane.
  • Fix these two failures if present: 1.2.1 (anonymous auth) and 1.2.7 (profiling).
  • Leave the API server running.

Acceptance criteria

  • kube-bench run --targets master --check 1.2.1 reports [PASS].
  • Same for 1.2.7.
  • kubectl get --raw /healthz returns ok.

Solution

sudo kube-bench run --targets master | grep -E '^\[FAIL\]' | head -20
sudo cp /etc/kubernetes/manifests/kube-apiserver.yaml /root/apiserver.bak
sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

In the command: list:

    - --anonymous-auth=false
    - --profiling=false
sleep 20
sudo crictl ps | grep kube-apiserver
kubectl get --raw /healthz
sudo kube-bench run --targets master --check 1.2.1

If the API server does not come back: sudo crictl logs <id> shows the parse
error, fix the indentation, wait 20 s. Never delete the manifest.