Ensure the kubelet X.509 client CA file is configured

How it is checked

Audit method: Shell command

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"clientCAFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

If the audit shows that the kubelet X.509 client CA file is not configured, the worker node should be treated as noncompliant. If the result is empty, null, or missing, first confirm the inspection reflects the effective node configuration. In OKE, remediation should be performed through the supported managed node initialization, node pool update, or node replacement workflow, because Oracle supports custom cloud-init initialization scripts for managed nodes and updated node pool properties are applied when replacement managed nodes are started. Remediation of new cluster When creating a new OKE cluster or node group, the goal is to ensure each worker node starts with a trusted client CA bundle already present and with the kubelet configured to use it for certificate-based client authentication.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target oke