Linux Foundation CKS Exam - Topic 1 Question 55 Discussion

Actual exam question for Linux Foundation's CKS exam

Question #: 55
Topic #: 1

[All CKS Questions]

You can switch the cluster/configuration context using the following command: [desk@cli] $kubectl config use-context dev Context: A CIS Benchmark tool was run against the kubeadm created cluster and found multiple issues that must be addressed. Task: Fix all issues via configuration and restart the affected components to ensure the new settings take effect. Fix all of the following violations that were found against the API server: 1.2.7authorization-modeargument is not set toAlwaysAllow FAIL 1.2.8authorization-modeargument includesNode FAIL 1.2.7authorization-modeargument includesRBAC FAIL Fix all of the following violations that were found against the Kubelet: 4.2.1 Ensure that theanonymous-auth argumentis set to false FAIL 4.2.2authorization-modeargument is not set to AlwaysAllow FAIL (UseWebhookautumn/authz where possible) Fix all of the following violations that were found against etcd: 2.2 Ensure that theclient-cert-authargument is set to true

AExplanation:
worker1 $ vim /var/lib/kubelet/config.yaml
anonymous:
enabled: true #Delete this
enabled: false #Replace by this
authorization:
mode: AlwaysAllow #Delete this
mode: Webhook #Replace by this
worker1 $ systemctl restart kubelet. # To reload kubelet config

ssh to master1

master1 $ vim /etc/kubernetes/manifests/kube-apiserver.yaml
- -- authorization-mode=Node,RBAC

master1 $ vim /etc/kubernetes/manifests/etcd.yaml
- --client-cert-auth=true
Explanation
ssh to worker1
worker1 $ vim /var/lib/kubelet/config.yaml
apiVersion: kubelet.config.k8s.io/v1beta1
authentication:
anonymous:
enabled: true #Delete this
enabled: false #Replace by this
webhook:
cacheTTL: 0s
enabled: true
x509:
clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
mode: AlwaysAllow #Delete this
mode: Webhook #Replace by this
webhook:
cacheAuthorizedTTL: 0s
cacheUnauthorizedTTL: 0s
cgroupDriver: systemd
clusterDNS:
- 10.96.0.10
clusterDomain: cluster.local
cpuManagerReconcilePeriod: 0s
evictionPressureTransitionPeriod: 0s
fileCheckFrequency: 0s
healthzBindAddress: 127.0.0.1
healthzPort: 10248
httpCheckFrequency: 0s
imageMinimumGCAge: 0s
kind: KubeletConfiguration
logging: {}
nodeStatusReportFrequency: 0s
nodeStatusUpdateFrequency: 0s
resolvConf: /run/systemd/resolve/resolv.conf
rotateCertificates: true
runtimeRequestTimeout: 0s
staticPodPath: /etc/kubernetes/manifests
streamingConnectionIdleTimeout: 0s
syncFrequency: 0s
volumeStatsAggPeriod: 0s
worker1 $ systemctl restart kubelet. # To reload kubelet config

ssh to master1
master1 $ vim /etc/kubernetes/manifests/kube-apiserver.yaml

master1 $ vim /etc/kubernetes/manifests/etcd.yaml

Show Suggested Answer

Suggested Answer: A

by Arminda at May 23, 2024, 11:12 AM

Limited Time Offer

25%

Off

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Francis

4 months ago

I disagree, using AlwaysAllow can expose the cluster to security risks.

upvoted 0 times

...

Elenora

4 months ago

Just fix the config and restart the components, right? Simple enough.

upvoted 0 times

...

Cheryl

4 months ago

Surprised to see RBAC included in the violations. Thought it was standard!

upvoted 0 times

...

Gilberto

4 months ago

Yeah, definitely need to set anonymous-auth to false.

upvoted 0 times

...

Anabel

5 months ago

AlwaysAllow for authorization mode? That's risky!

upvoted 0 times

...

Julio

5 months ago

I recall that the kubelet config changes should be made in /var/lib/kubelet/config.yaml, but I’m not entirely sure about the exact syntax for the authorization mode.

upvoted 0 times

...

Malinda

5 months ago

I think the etcd configuration needs client-cert-auth set to true, but I’m a bit confused about where to find the etcd.yaml file.

upvoted 0 times

...

Lilli

5 months ago

I practiced a similar question where we had to set anonymous-auth to false for the Kubelet. I think it’s crucial to restart the service afterward.

upvoted 0 times

...

Vanesa

5 months ago

I remember that for the API server, we need to change the authorization modes, but I'm not sure if I should remove both Node and RBAC.

upvoted 0 times

...

Apolonia

5 months ago

Okay, I've got a plan. I'll start with the Kubelet, then move on to the API server, and finally update the etcd configuration. I'll be sure to restart the affected components after each change to make sure the new settings are applied.

upvoted 0 times

...

Johnathon

5 months ago

I want to make sure I understand the context fully before making any changes. Can someone confirm if these are the only issues that need to be addressed, or are there any other violations I should be aware of?

upvoted 0 times

...

Carin

5 months ago

The API server configuration changes seem pretty clear-cut. I'll update the authorization mode arguments in the manifest file and restart the API server to ensure the new settings take effect.

upvoted 0 times

...

Isaac

5 months ago

Hmm, I'm a bit confused about the etcd configuration changes. Do I need to update the manifest file directly or is there another way to apply those changes?

upvoted 0 times

...

Chun

6 months ago

This looks like a straightforward configuration issue. I'll start by updating the Kubelet configuration on the worker nodes to address the anonymous auth and authorization mode violations.

upvoted 0 times

...

Katie

6 months ago

Hmm, I'm a bit unsure about this one. I know conventional theory assumes concave utility functions, but I'm not totally clear on the specifics of prospect theory's assumptions.

upvoted 0 times

...

Bettina

6 months ago

I'm a bit confused on the requirements for zone1. Does it need a physical network interface, or can it use a virtual one? That could impact the solution.

upvoted 0 times

...