Ensure the kubelet client certificate rotation is enabled

Como é verificado

Método de auditoria: Comando shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

If the audit returns false, the worker node is not configured to rotate its kubelet client certificate and should be treated as noncompliant. If the field is not present, interpret that conservatively as rotation not enabled unless your EKS platform explicitly manages certificate rotation for you. AWS’s self-managed EKS node guidance states that kubelet certificates have a one-year expiration, that certificate rotation is not enabled by default, and that nodes can lose the ability to authenticate to the Kubernetes API if they remain in service beyond that period without renewal. Kubernetes also defines rotateCertificates as the kubelet setting that enables client certificate rotation and gives it a default of false.

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target eks