Ensure kubelet tlsCertFile and tlsPrivateKeyFile are configured appropriately

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"tlsCertFile":"[^"]+"' && printf '%s' "$c" | grep -Eq '"tlsPrivateKeyFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Beklenen çıktı

compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

If the audit shows that the kubelet serving certificate and private key are not configured appropriately, first confirm the inspection reflects the effective node configuration. In OKE, remediation should be performed through the supported managed node initialization, node pool update, or node replacement workflow, not by directly editing the kubelet config file on the host. Oracle supports custom cloud-init initialization scripts for managed nodes, including kubelet extra args, and updated worker node properties are applied through new or replacement worker nodes. Remediation of new cluster When creating a new OKE cluster or node pool, ensure each worker node starts with the intended kubelet serving certificate and private key configuration. If customization is required, place the certificate, private key, and kubelet reference in the supported managed node initialization path.

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

tmaegis scan --target oke