Ensure that the --root-ca-file argument is set as appropriate

SrednjaNivo 1Ručni pregledopenshift

Opis

Allow pods to verify the API server's serving certificate before establishing connections. The benchmark marks this recommendation Manual.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Certificates for OpenShift platform components are automatically created and rotated by the OpenShift Container Platform. Run the following command: oc get configmaps config -n openshift-kube-controller-manager -ojson | \ jq -r '.data["config.yaml"]' | \ jq -r '.extendedArguments["root-ca-file"][]' Verify that the --root-ca-file argument exists and is set to /etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

set --root-ca-file argument

Svojstva

Operativni sistemi: Bilo koji
Oznake: openshiftcontroller-manager
Referenca: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 1.3.4 Ensure that the --root-ca-file argument is set as appropriate