Ensure serverTLSBootstrap and RotateKubeletServerCertificate are enabled

Как проверяется

Метод проверки: Команда оболочки

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"serverTLSBootstrap":true' && ! printf '%s' "$c" | grep -Eq '"RotateKubeletServerCertificate":false'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Ожидаемый вывод

compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

If the audit shows serverTLSBootstrap is false, the kubelet is not entering the Kubernetes certificates API workflow for its serving certificate and the node should be treated as noncompliant. If RotateKubeletServerCertificate is false, or becomes unset because custom feature gates were supplied without re-including it, the related server certificate rotation support is not being preserved. If either field is missing, first confirm the configz response is complete, because Kubernetes identifies that endpoint as the view of the kubelet’s final actuated configuration. In EKS, remediation should be performed through the supported node provisioning or node update workflow, not by directly editing the kubelet config file on the host, because AWS applies durable node behavior through launch templates, merged user data, and managed node replacement workflows.

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

tmaegis scan --target eks