Ensure kubelet tlsCertFile and tlsPrivateKeyFile are configured appropriately

Cara pemeriksaan

Metode audit: Perintah shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"tlsCertFile":"[^"]+"' && printf '%s' "$c" | grep -Eq '"tlsPrivateKeyFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Output yang diharapkan

compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

If the audit shows that the kubelet serving certificate and private key are not configured appropriately, first confirm the inspection reflects the effective node configuration. In OKE, remediation should be performed through the supported managed node initialization, node pool update, or node replacement workflow, not by directly editing the kubelet config file on the host. Oracle supports custom cloud-init initialization scripts for managed nodes, including kubelet extra args, and updated worker node properties are applied through new or replacement worker nodes. Remediation of new cluster When creating a new OKE cluster or node pool, ensure each worker node starts with the intended kubelet serving certificate and private key configuration. If customization is required, place the certificate, private key, and kubelet reference in the supported managed node initialization path.

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

tmaegis scan --target oke