TMA-AKS-3.2.3

Ensure that the --client-ca-file argument is set as appropriate

높음레벨 1자동aks

설명

This worker-node kubelet setting ensures that the --client-ca-file argument is configured with a trusted certificate authority file so the kubelet can validate client certificates presented to its HTTPS endpoint. This helps ensure that certificate-based access to the kubelet is restricted to clients signed by an approved CA. Reads every node's effective kubelet configuration through the API server (kubectl get --raw /api/v1/nodes/<node>/proxy/configz); requires kubectl with nodes/proxy access.

점검 방법

감사 방식: 셸 명령

shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"clientCAFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

If the --client-ca-file parameter is not set to a valid file path, and manual modification is required, review the following file, which contains the KUBELET_FLAGS values used to build the kubelet command-line parameters. /etc/default/kubelet Before editing anything, enter debug mode and run chroot to verify what your node is actually using: kubectl debug node/$NODE_NAME -it --image=$IMAGE --profile=general chroot /host systemctl cat kubelet If the service shows an EnvironmentFile=/etc/default/kubelet and references KUBELET_FLAGS, that is the file you would edit. If it does not, then the next place to check is the kubelet systemd unit or drop-in, such as: /etc/systemd/system/kubelet.service /etc/systemd/system/kubelet.service.d/*.conf After a changing the kubelet config file, restart the kubelet service and check status.

속성

운영 체제: 모두
태그: aksworker-node
참고 자료: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 3.2.3 Ensure that the --client-ca-file argument is set as appropriate

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aks