Ensure that rotateCertificates is set to true

점검 방법

감사 방식: 셸 명령

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

예상 출력

compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

If an audit shows rotateCertificates set to false or blank, the preferred remediation is to replace the affected node pool with a new pool and let the kubelet come up through the normal AKS node-pool configuration path, rather than trying to force a one-off manual change onto existing nodes. This is the preferred approach because the setting affects kubelet client certificate rotation, which is part of how each node maintains authenticated trust with the Kubernetes API server over time. Rebuilding the pool allows new nodes to be provisioned, bootstrapped, and joined through the same managed configuration path, which helps ensure consistent kubelet behavior across the pool and avoids carrying forward nodes whose certificate lifecycle or startup arguments may already have drifted from the intended state.

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

tmaegis scan --target aks --level 2