A kube-bench run against a worker node reports two failures: *"Ensure that the --anonymous-auth argument is set to false"* and *"Ensure that the --authorization-mode argument is not set to AlwaysAllow"*. The kubelet on this node is started by systemd with a single flag, --config=/var/lib/kubelet/config.yaml, and all other settings come from that file.
You must remediate both findings so that unauthenticated callers of the kubelet API on port 10250 are rejected and every authenticated request is checked against the API server. What should you do?