Ensure that the --rotate-certificates argument is not set to false

MediumLevel 2Manual reviewopenshift

Description

Enable kubelet client certificate rotation. The benchmark marks this recommendation Manual.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

This feature also requires the RotateKubeletClientCertificate feature gate to be enabled. The feature gate is enabled by default. Run the following command to check that certificate rotation is enabled for each node: for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig.rotateCertificates' done Verify all the nodes return true.

How it is fixed

Fix method: Guidance or infrastructure patch

Set --rotate-certificates argument to true.

Properties

Operating systems: Any
Tags: openshiftworker-nodekubelet
Reference: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 4.2.10 Ensure that the --rotate-certificates argument is not set to false