Ensure the kubelet client certificate rotation is enabled

Како се проверава

Метод провере: Команда љуске

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

If the audit returns false, the worker node is not configured to rotate its kubelet client certificate and should be treated as noncompliant. If the field is not present, interpret that conservatively as rotation not enabled unless your EKS platform explicitly manages certificate rotation for you. AWS’s self-managed EKS node guidance states that kubelet certificates have a one-year expiration, that certificate rotation is not enabled by default, and that nodes can lose the ability to authenticate to the Kubernetes API if they remain in service beyond that period without renewal. Kubernetes also defines rotateCertificates as the kubelet setting that enables client certificate rotation and gives it a default of false.

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target eks