Ensure that the RotateKubeletServerCertificate argument is set to true

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"RotateKubeletServerCertificate":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

If an audit shows RotateKubeletServerCertificate set to false or blank, the preferred remediation method is to replace the affected node pool with a new pool and let the kubelet come up through the normal AKS-managed bootstrap path, rather than trying to update the setting manually into existing nodes. This is preferred because the kubelet serving certificate rotation in Kubernetes is tied to serverTLSBootstrap, which moves the kubelet away from a self-signed serving certificate and into the CSR-based certificate workflow, while AKS treats kubelet serving certificate rotation as a managed platform capability on supported node pools. In addition, replacing the node pool gives you a consistent, repeatable way to bring every node up through the same managed certificate path.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target aks