Ensure kubelet tlsCertFile and tlsPrivateKeyFile are configured appropriately

Kako se proverava

Metod provere: Komanda ljuske

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"tlsCertFile":"[^"]+"' && printf '%s' "$c" | grep -Eq '"tlsPrivateKeyFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Očekivani izlaz

compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

If the audit shows that the kubelet serving certificate and private key are not configured appropriately, first confirm the inspection reflects the effective node configuration. In OKE, remediation should be performed through the supported managed node initialization, node pool update, or node replacement workflow, not by directly editing the kubelet config file on the host. Oracle supports custom cloud-init initialization scripts for managed nodes, including kubelet extra args, and updated worker node properties are applied through new or replacement worker nodes. Remediation of new cluster When creating a new OKE cluster or node pool, ensure each worker node starts with the intended kubelet serving certificate and private key configuration. If customization is required, place the certificate, private key, and kubelet reference in the supported managed node initialization path.

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

tmaegis scan --target oke