Ensure that the RotateKubeletServerCertificate argument is set to true

보통레벨 1자동aks

설명

The RotateKubeletServerCertificate argument is a control that corresponds to kubelet serving certificate rotation. In practical terms, it means the kubelet uses server TLS bootstrapping to obtain and rotate a serving certificate signed by the cluster CA for the kubelet’s own HTTPS endpoint, rather than relying on a locally self-signed serving certificate. Reads every node's effective kubelet configuration through the API server (kubectl get --raw /api/v1/nodes/<node>/proxy/configz); requires kubectl with nodes/proxy access. A false or blank RotateKubeletServerCertificate feature gate fails.

점검 방법

감사 방식: 셸 명령

shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"RotateKubeletServerCertificate":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

If an audit shows RotateKubeletServerCertificate set to false or blank, the preferred remediation method is to replace the affected node pool with a new pool and let the kubelet come up through the normal AKS-managed bootstrap path, rather than trying to update the setting manually into existing nodes. This is preferred because the kubelet serving certificate rotation in Kubernetes is tied to serverTLSBootstrap, which moves the kubelet away from a self-signed serving certificate and into the CSR-based certificate workflow, while AKS treats kubelet serving certificate rotation as a managed platform capability on supported node pools. In addition, replacing the node pool gives you a consistent, repeatable way to bring every node up through the same managed certificate path.

속성

운영 체제: 모두
태그: aksworker-nodekubelet
참고 자료: CIS Azure Kubernetes Service (AKS) Benchmark v2.0.0 - 3.2.8 Ensure that the RotateKubeletServerCertificate argument is set to true

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target aks