Fix all issues via configuration and restart the affected components to ensure the new setting takes effect. Fix all of the following violations that were found against the API server:- a. Ensure…

This simulation tests your ability to remediate CIS Kubernetes Benchmark violations identified by kube-bench across three core components: the API Server, Kubelet, and etcd. You must edit configuration files and restart affected services to enforce secure settings.

Submitted by andreas_gr· May 5, 2026Cluster Hardening

Question

Fix all issues via configuration and restart the affected components to ensure the new setting takes effect. Fix all of the following violations that were found against the API server:- a. Ensure the --authorization-mode argument includes RBAC b. Ensure the --authorization-mode argument includes Node c. Ensure that the --profiling argument is set to false Fix all of the following violations that were found against the Kubelet:- a. Ensure the --anonymous-auth argument is set to false. b. Ensure that the --authorization-mode argument is set to Webhook. Fix all of the following violations that were found against the ETCD:- a. Ensure that the --auto-tls argument is not set to true Hint: Take the use of Tool Kube-Bench

Explanation

Approach. API Server (/etc/kubernetes/manifests/kube-apiserver.yaml): Set --authorization-mode=Node,RBAC (both are required - Node authorizes kubelet API requests, RBAC enforces role-based access control) and add --profiling=false (disables the /debug/pprof endpoint to prevent information leakage). Since this is a static pod, saving the manifest automatically triggers a restart by the kubelet. Kubelet (/var/lib/kubelet/config.yaml or via --config): Set anonymous: enabled: false under authentication (maps to --anonymous-auth=false, rejecting unauthenticated requests) and set authorization: mode: Webhook (delegates authorization decisions to the API server); restart with 'systemctl daemon-reload && systemctl restart kubelet'. ETCD (/etc/kubernetes/manifests/etcd.yaml): Remove the --auto-tls=true argument entirely or explicitly set it to false - auto-tls generates self-signed certificates which are insecure in production; etcd restarts automatically as a static pod when the manifest is changed.

Concept tested. Kubernetes CIS Benchmark hardening: securing the API Server (authorization modes, profiling), Kubelet (anonymous auth, webhook authorization), and etcd (disabling auto-TLS) using kube-bench findings as a remediation guide

Reference. CIS Kubernetes Benchmark v1.9 - Controls 1.2.7 (Node authz), 1.2.8 (RBAC), 1.2.21 (profiling), 4.2.1 (kubelet anonymous-auth), 4.2.2 (kubelet Webhook), 2.3 (etcd auto-tls); https://github.com/aquasecurity/kube-bench

Topics

#API Server Hardening#Kubelet Security#ETCD Configuration#CIS Benchmarks

Community Discussion

No community discussion yet for this question.

Full CKS Practice