Ensure that the --root-ca-file argument is set as appropriate

SedangLevel 1Tinjauan manualopenshift

Deskripsi

Allow pods to verify the API server's serving certificate before establishing connections. The benchmark marks this recommendation Manual.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Certificates for OpenShift platform components are automatically created and rotated by the OpenShift Container Platform. Run the following command: oc get configmaps config -n openshift-kube-controller-manager -ojson | \ jq -r '.data["config.yaml"]' | \ jq -r '.extendedArguments["root-ca-file"][]' Verify that the --root-ca-file argument exists and is set to /etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt.

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

set --root-ca-file argument

Properti

Sistem operasi: Apa saja
Tag: openshiftcontroller-manager
Referensi: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 1.3.4 Ensure that the --root-ca-file argument is set as appropriate