TMA-OKE-3.2.8

Ensure the kubelet client certificate rotation is enabled

CaoCấp 1Tự độngoke

Mô tả

In OKE, the setting rotateCertificates is about whether the kubelet renews its client certificate before that certificate expires. Oracle OKE documentation shows worker nodes using the kubelet client certificate at /var/lib/kubelet/pki/kubelet-client-current.pem, which is trusted by the cluster CA, but Oracle does not publish a fixed OKE default for rotateCertificates. Reads every node's effective kubelet configuration through the API server (kubectl get --raw /api/v1/nodes/<node>/proxy/configz); requires kubectl with nodes/proxy access.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"rotateCertificates":true'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

If the audit returns false, the worker node is not configured to rotate its kubelet client certificate and should be treated as noncompliant. If the field is not present, interpret that conservatively as rotation not enabled unless your OKE platform explicitly manages certificate rotation for you. Oracle OKE documentation shows worker nodes using kubelet client certificates trusted by the cluster CA and supports managed node customization through cloud-init initialization scripts and kubelet extra args. Oracle also documents that worker node property changes can be applied through new or replacement managed nodes. Remediation of new cluster When creating a new OKE cluster or node pool, the goal is to ensure worker nodes start with kubelet client certificate rotation enabled if the nodes may remain in service long enough for certificate expiry to matter.

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: okeworker-nodekubelet
Tham chiếu: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 3.2.8 Ensure the kubelet client certificate rotation is enabled

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target oke