Ensure the kubelet client certificate rotation is enabled

Cómo se verifica

Método de auditoría: Comando de shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

If the audit returns false, the worker node is not configured to rotate its kubelet client certificate and should be treated as noncompliant. If the field is not present, interpret that conservatively as rotation not enabled unless your EKS platform explicitly manages certificate rotation for you. AWS’s self-managed EKS node guidance states that kubelet certificates have a one-year expiration, that certificate rotation is not enabled by default, and that nodes can lose the ability to authenticate to the Kubernetes API if they remain in service beyond that period without renewal. Kubernetes also defines rotateCertificates as the kubelet setting that enables client certificate rotation and gives it a default of false.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target eks