Ensure that rotateCertificates is set to true

Méthode de vérification

Méthode d'audit: Commande shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Sortie attendue

compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

If an audit shows rotateCertificates set to false or blank, the preferred remediation is to replace the affected node pool with a new pool and let the kubelet come up through the normal AKS node-pool configuration path, rather than trying to force a one-off manual change onto existing nodes. This is the preferred approach because the setting affects kubelet client certificate rotation, which is part of how each node maintains authenticated trust with the Kubernetes API server over time. Rebuilding the pool allows new nodes to be provisioned, bootstrapped, and joined through the same managed configuration path, which helps ensure consistent kubelet behavior across the pool and avoids carrying forward nodes whose certificate lifecycle or startup arguments may already have drifted from the intended state.

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

tmaegis scan --target aks --level 2