Ensure the kubelet X.509 client CA file is configured

チェック方法

監査方法: シェルコマンド

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"clientCAFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

期待される出力

compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

If the audit shows that the kubelet X.509 client CA file is not configured, the worker node should be treated as noncompliant. If the result is empty, null, or missing, first confirm the inspection reflects the effective node configuration. In Amazon EKS, remediation should be performed through the supported node provisioning or node update workflow, because AWS documents that kubelet authentication is a managed field in eksctl, launch templates are the supported path for deeper managed node customization, and client certificate signing is not supported by the Amazon EKS CA signer. Remediation of new cluster When creating a new EKS cluster or node group, the goal is to ensure each worker node starts with a trusted client CA bundle already present and with the kubelet configured to use it for certificate-based client authentication.

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

tmaegis scan --target eks