Ensure the kubelet X.509 client CA file is configured

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"clientCAFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If the audit shows that the kubelet X.509 client CA file is not configured, the worker node should be treated as noncompliant. If the result is empty, null, or missing, first confirm the inspection reflects the effective node configuration. In OKE, remediation should be performed through the supported managed node initialization, node pool update, or node replacement workflow, because Oracle supports custom cloud-init initialization scripts for managed nodes and updated node pool properties are applied when replacement managed nodes are started. Remediation of new cluster When creating a new OKE cluster or node group, the goal is to ensure each worker node starts with a trusted client CA bundle already present and with the kubelet configured to use it for certificate-based client authentication.

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target oke