Ensure the kubelet X.509 client CA file is configured

Cómo se verifica

Método de auditoría: Comando de shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"clientCAFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

If the audit shows that the kubelet X.509 client CA file is not configured, the worker node should be treated as noncompliant. If the result is empty, null, or missing, first confirm the inspection reflects the effective node configuration. In Amazon EKS, remediation should be performed through the supported node provisioning or node update workflow, because AWS documents that kubelet authentication is a managed field in eksctl, launch templates are the supported path for deeper managed node customization, and client certificate signing is not supported by the Amazon EKS CA signer. Remediation of new cluster When creating a new EKS cluster or node group, the goal is to ensure each worker node starts with a trusted client CA bundle already present and with the kubelet configured to use it for certificate-based client authentication.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target eks