Ensure the kubelet X.509 client CA file is configured

Како се проверава

Метод провере: Команда љуске

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"clientCAFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Очекивани излаз

compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

If the audit shows that the kubelet X.509 client CA file is not configured, the worker node should be treated as noncompliant. If the result is empty, null, or missing, first confirm the inspection reflects the effective node configuration. In OKE, remediation should be performed through the supported managed node initialization, node pool update, or node replacement workflow, because Oracle supports custom cloud-init initialization scripts for managed nodes and updated node pool properties are applied when replacement managed nodes are started. Remediation of new cluster When creating a new OKE cluster or node group, the goal is to ensure each worker node starts with a trusted client CA bundle already present and with the kubelet configured to use it for certificate-based client authentication.

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

tmaegis scan --target oke