TMA-OKE-3.2.1

Ensure kubelet anonymous authentication is disabled

심각레벨 1자동oke

설명

In Oracle OKE, this control means the kubelet on managed or self managed worker nodes must not accept unauthenticated requests. OKE worker nodes run kubelet to communicate with the cluster control plane, and kubelet behavior can be configured through supported worker node startup or provisioning configuration. Reads every node's effective kubelet configuration through the API server (kubectl get --raw /api/v1/nodes/<node>/proxy/configz); requires kubectl with nodes/proxy access.

점검 방법

감사 방식: 셸 명령

shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"anonymous":\{"enabled":false\}'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

If the audit returns true, the worker node is allowing anonymous requests to the kubelet and should be treated as noncompliant. If the result is null or the field is missing, first confirm the configz response is complete, because Kubernetes identifies that endpoint as the view of the kubelet’s final effective configuration. Once the result is validated, remediation in OKE should be performed through the supported worker node provisioning or node update workflow, not by directly editing the kubelet config file on the host. OKE supports custom cloud-init scripts for managed nodes, and the corrected setting should be applied by creating, cycling, or replacing worker nodes. Remediation of new cluster When creating a new OKE cluster or node pool, the goal is to ensure worker nodes join the cluster with kubelet anonymous authentication already disabled.

속성

운영 체제: 모두
태그: okeworker-nodekubelet
참고 자료: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 3.2.1 Ensure kubelet anonymous authentication is disabled

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target oke