Question
A security architect needs to enable a container orchestrator for DevSecOps and SOAR initiatives. The engineer has discovered that several Ansible YAML files used for the automation of configuration management have the following content:
```
$ hostnamectl
COMPTIA001
$ cat /etc/ansible/ansible.cfg
[inventory]
enable_plugins = kubernetes.core.k8s
$ cat /etc/ansible/projects/roles/k8/default/main.yml
---
- Name: Create a Kubernetes Service Objects
kubernetes.core.k8s:
state: present
definition:
apiVersion: v2
kind: Service
$ cat /etc/kubernetes/manifests
insecure-bind-address "localhost"
```
Which of the following should the engineer do to correct the security issues presented within this content?
- A. Update the kubernetes.core.k8s module to kubernetes.core.k8s_service in the main.yml file.
- B. Update the COMPTIA001 hostname to localhost using the hostnamectl command.
- C. Update the state: present module to state: absent in the main.yml file.
- D. Update or remove the ansible.cfg file.
- E. Update the insecure-bind-address from localhost to the COMPTIA001 in the manifests file. Correct
Explanation
The security-relevant item in the exhibit is the insecure-bind-address setting in the Kubernetes manifest, which controls where the API server's unauthenticated HTTP port listens, so that is the line to correct. The other options change functional details: the module name, the hostname, the desired state of the Service object and the inventory plugin setting do not address a security weakness. Be aware that current Kubernetes releases have removed the insecure port entirely, and in practice the safest fix is to delete this flag rather than bind it to a network-reachable host name.
