---
# System prepended metadata

title: 第十二题 CIS Kube-bench
tags: [真题讲解]

---

# 第十二题 CIS Kube-bench
###### tags: `真题讲解`
切换集群kubectl config use-context k8s65

**Context**
A CIS Benchmark tool was run against the kubeadm-created cluster and found multiple issues that must be addressed immediately.

**Task**
Fix all issues via configuration and restart theaffected components to ensure the new settings take effect.
Fix all of the following violations that were found against the API server:
```
Ensure that the
1.2.7 --authorization-mode FAIL argument is not set to AlwaysAllow
Ensure that the
1.2.8 --authorization-mode FAIL argument includes Node
Ensure that the
1.2.9 --authorization-mode FAIL argument includes RBAC
Ensure that the
1.2.18 --insecure-bind-address FAIL argument is not set
Ensure that the
1.2.19 --insecure-port FAIL argument is set to 0
```

Fix all of the following violations that were found against the kubelet:
```
Ensure that the
4.2.1 anonymous-auth FAIL argument is set to false
Ensure that the
4.2.2 --authorization-mode FAIL argument is not set to AlwaysAllow
```
Use webhook authn/authz where possible.

## 解法
**Master Node**

修正APIServer, /etc/kubernetes/manifests# vim kube-apiserver.yaml, 记得最好备份一下.
如果见到--insecure-bind-address参数直接整行删掉
![](https://i.imgur.com/KZcTaat.png)

**Worker Node**
Kubelet 参数位置在/var/lib/kubelet/config.yaml
按要求改成如下配置, 其实就是默认配置, 如果记不住其实可以直接复制Master Node上相同的文件 :wink: 
![](https://i.imgur.com/dTEiMmF.png)
