Ensure the kubelet read-only port is disabled

Kako se proverava

Metod provere: Komanda ljuske

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { ! printf '%s' "$c" | grep -Eq '"readOnlyPort":[1-9]'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

If the audit returns a nonzero readOnlyPort, the worker node is exposing the kubelet read-only service and should be treated as noncompliant. If the field is missing from configz, first confirm whether it is simply omitted because the effective value is 0, since the kubelet configuration schema defines readOnlyPort as the unauthenticated read-only service and states that 0 disables it. Once a noncompliant state is confirmed, remediation in EKS should be performed through the supported node provisioning or node update workflow, not by directly editing the kubelet config file on the host. AWS documents that managed node customization is applied through launch templates and bootstrap logic, and that updating a managed node group to a new launch template version replaces the nodes to match that configuration.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target eks