Root CA file not defined

This product is not supported for your selected Datadog site. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: 05fb986f-ac73-4ebb-a5b2-7faafa93d882

Cloud Provider: Kubernetes

Platform: Kubernetes

Severity: Medium

Category: Encryption

Learn More

Description

Containers (including initContainers) that run kube-controller-manager should include the --root-ca-file flag. This flag specifies the path to the root CA certificate used to validate TLS certificates; without it the controller manager may not validate certificates correctly. The rule reports a MissingAttribute when the --root-ca-file flag is not present in the container’s command.

Compliant Code Examples

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0
      command: ["kube-controller-manager"]
      args: ["--root-ca-file=/path/to/ca/file.pem"]
  restartPolicy: OnFailure

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0
      command: ["kube-controller-manager","--root-ca-file=/path/to/ca/file.pem"]
      args: []
  restartPolicy: OnFailure

Non-Compliant Code Examples

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0
      command: ["kube-controller-manager"]
      args: []
  restartPolicy: OnFailure