Ensure serverTLSBootstrap and RotateKubeletServerCertificate are enabled

CaoCấp 1Tự độngeks

Mô tả

In EKS, these settings are about the kubelet’s serving certificate, which is the certificate the kubelet presents from its HTTPS endpoint to callers. serverTLSBootstrap controls whether the kubelet uses the Kubernetes certificates API to bootstrap that serving certificate, while RotateKubeletServerCertificate keeps the related rotation support enabled when feature gates are managed. Reads every node's effective kubelet configuration through the API server (kubectl get --raw /api/v1/nodes/<node>/proxy/configz); requires kubectl with nodes/proxy access. RotateKubeletServerCertificate must not be false (it defaults to true).

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"serverTLSBootstrap":true' && ! printf '%s' "$c" | grep -Eq '"RotateKubeletServerCertificate":false'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If the audit shows serverTLSBootstrap is false, the kubelet is not entering the Kubernetes certificates API workflow for its serving certificate and the node should be treated as noncompliant. If RotateKubeletServerCertificate is false, or becomes unset because custom feature gates were supplied without re-including it, the related server certificate rotation support is not being preserved. If either field is missing, first confirm the configz response is complete, because Kubernetes identifies that endpoint as the view of the kubelet’s final actuated configuration. In EKS, remediation should be performed through the supported node provisioning or node update workflow, not by directly editing the kubelet config file on the host, because AWS applies durable node behavior through launch templates, merged user data, and managed node replacement workflows.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: eksworker-nodekubelet
Tham chiếu: CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v2.0.0 - 3.2.8 Ensure serverTLSBootstrap and RotateKubeletServerCertificate are enabled

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target eks