Ensure the kubelet read-only port is disabled

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

To audit whether the kubelet read-only port is disabled on an OKE worker node, query the live effective kubelet configuration through the Kubernetes API server proxy and inspect the kubelet configz output for readOnlyPort set to 0. Kubernetes identifies configz as the view of the kubelet’s final actuated configuration, and the kubelet configuration schema defines readOnlyPort as the setting that controls the unauthenticated read-only kubelet service.

修正方法

修正方法: ガイダンスまたは IaC パッチ

If the audit returns a nonzero readOnlyPort``, the worker node is exposing the kubelet read-only service and should be treated as noncompliant. If the field is missing from configz, first confirm whether it is simply omitted because the effective value is 0, since the kubelet configuration schema defines readOnlyPortas the unauthenticated read-only service and states that0` disables it. Once a noncompliant state is confirmed, remediation in OKE should be performed through the supported managed node initialization, node pool update, or node replacement workflow, not by directly editing the kubelet config file on the host. Oracle documents that OKE managed nodes use cloud-init initialization scripts, that custom logic can be added without modifying the default OKE initialization logic, and that updated worker node properties are applied by starting replacement worker nodes.