Ensure that the --rotate-certificates argument is not set to false

SrednjaNivo 2Ručni pregledopenshift

Opis

Enable kubelet client certificate rotation. The benchmark marks this recommendation Manual.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

This feature also requires the RotateKubeletClientCertificate feature gate to be enabled. The feature gate is enabled by default. Run the following command to check that certificate rotation is enabled for each node: for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig.rotateCertificates' done Verify all the nodes return true.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Set --rotate-certificates argument to true.

Svojstva

Operativni sistemi: Bilo koji
Oznake: openshiftworker-nodekubelet
Referenca: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 4.2.10 Ensure that the --rotate-certificates argument is not set to false