Ensure kubelet tlsCertFile and tlsPrivateKeyFile are configured appropriately

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"tlsCertFile":"[^"]+"' && printf '%s' "$c" | grep -Eq '"tlsPrivateKeyFile":"[^"]+"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Đầu ra mong đợi

compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If the audit shows that the kubelet serving certificate and private key are not configured appropriately, first confirm the inspection reflects the effective node configuration. In OKE, remediation should be performed through the supported managed node initialization, node pool update, or node replacement workflow, not by directly editing the kubelet config file on the host. Oracle supports custom cloud-init initialization scripts for managed nodes, including kubelet extra args, and updated worker node properties are applied through new or replacement worker nodes. Remediation of new cluster When creating a new OKE cluster or node pool, ensure each worker node starts with the intended kubelet serving certificate and private key configuration. If customization is required, place the certificate, private key, and kubelet reference in the supported managed node initialization path.

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

tmaegis scan --target oke