Use OCI IAM or OIDC tokens instead of user client certificates

높음레벨 1수동 검토oke

설명

OKE authenticates cluster users through OCI IAM by default, and enhanced clusters can also be configured to use an external OIDC identity provider for user authentication. User access should rely on OCI IAM or OIDC tokens rather than Kubernetes client certificates, because these mechanisms align user access to managed identity, policy, and RBAC controls. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Review user access to the cluster and ensure that users are not making use of Kubernetes client certificate authentication. Review approved user kubeconfig files and confirm that user entries use OCI IAM generated tokens or OIDC tokens instead of client certificate fields. Run the following command to verify the authentication method configured for users in the current kubeconfig file: kubectl config view --raw -o json | jq -r ' .users[] | [ .name, ( if .user.exec then "exec_token" elif .user["auth-provider"]?.name == "oidc" then "oidc_token" elif .user.token then "static_token" ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Replace user kubeconfig entries that use client certificates with OCI IAM generated tokens or OIDC token based authentication. For OKE clusters, user authentication should align to the supported OKE access model, where OCI IAM is used by default and OIDC can be configured for external identity provider based authentication. This allows user access to be managed through identity, policy, and Kubernetes RBAC controls rather than long lived certificate material stored in kubeconfig files. • For OCI IAM based access, regenerate the user kubeconfig file from OKE using kubeconfig token version 2.0.0 so the user entry uses the OCI CLI exec plugin to generate authentication tokens. • For OIDC based access, configure the OKE cluster for OIDC authentication and update the user kubeconfig entry to use the approved OIDC identity provider token flow.

속성

운영 체제: 모두
태그: okecontrol-plane
참고 자료: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 2.1.1 Use OCI IAM or OIDC tokens instead of user client certificates