Ensure that rotateCertificates is set to true

チェック方法

監査方法: シェルコマンド

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

期待される出力

compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

If an audit shows rotateCertificates set to false or blank, the preferred remediation is to replace the affected node pool with a new pool and let the kubelet come up through the normal AKS node-pool configuration path, rather than trying to force a one-off manual change onto existing nodes. This is the preferred approach because the setting affects kubelet client certificate rotation, which is part of how each node maintains authenticated trust with the Kubernetes API server over time. Rebuilding the pool allows new nodes to be provisioned, bootstrapped, and joined through the same managed configuration path, which helps ensure consistent kubelet behavior across the pool and avoids carrying forward nodes whose certificate lifecycle or startup arguments may already have drifted from the intended state.

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

tmaegis scan --target aks --level 2