Ensure that rotateCertificates is set to true

Como é verificado

Método de auditoria: Comando shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

If an audit shows rotateCertificates set to false or blank, the preferred remediation is to replace the affected node pool with a new pool and let the kubelet come up through the normal AKS node-pool configuration path, rather than trying to force a one-off manual change onto existing nodes. This is the preferred approach because the setting affects kubelet client certificate rotation, which is part of how each node maintains authenticated trust with the Kubernetes API server over time. Rebuilding the pool allows new nodes to be provisioned, bootstrapped, and joined through the same managed configuration path, which helps ensure consistent kubelet behavior across the pool and avoids carrying forward nodes whose certificate lifecycle or startup arguments may already have drifted from the intended state.

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target aks --level 2