Ensure kubelet anonymous authentication is disabled

Como é verificado

Método de auditoria: Comando shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"anonymous":\{"enabled":false\}'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Saída esperada

compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

If the audit returns true, the worker node is allowing anonymous requests to the kubelet and should be treated as noncompliant. If the result is null or the field is missing, first confirm the configz response is complete, because Kubernetes identifies that endpoint as the view of the kubelet’s final effective configuration. Once the result is validated, remediation in OKE should be performed through the supported worker node provisioning or node update workflow, not by directly editing the kubelet config file on the host. OKE supports custom cloud-init scripts for managed nodes, and the corrected setting should be applied by creating, cycling, or replacing worker nodes. Remediation of new cluster When creating a new OKE cluster or node pool, the goal is to ensure worker nodes join the cluster with kubelet anonymous authentication already disabled.

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

tmaegis scan --target oke