Rotate Kubelet server certificate not active

Ce produit n'est pas pris en charge par le site Datadog que vous avez sélectionné. ().
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Metadata

Id: kubernetes-rotate-kubelet-server-certificate-not-active

Platform: Kubernetes

Severity: Medium

Category: Secret Management

Learn More

Description

The RotateKubeletServerCertificate feature gate must be set to true. It must be enabled either by including RotateKubeletServerCertificate=true in the --feature-gates= flag for kube components (for example kubelet or kube-controller-manager) or by setting featureGates.RotateKubeletServerCertificate to true in KubeletConfiguration. This rule reports an IncorrectValue when the feature gate is false.

Compliant Code Examples

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: "192.168.0.8"
port: 20250
serializeImagePulls: false
evictionHard:
    memory.available:  "200Mi"
featureGates:
    RotateKubeletServerCertificate: true

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: foo/bar
      command: ["kubelet"]
      args: ["--feature-gates=RotateKubeletServerCertificate=true"]
  restartPolicy: OnFailure

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: "192.168.0.8"
port: 20250
serializeImagePulls: false
evictionHard:
    memory.available:  "200Mi"

Non-Compliant Code Examples

apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
address: "192.168.0.8"
port: 20250
serializeImagePulls: false
evictionHard:
    memory.available:  "200Mi"
featureGates:
    RotateKubeletServerCertificate: false

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: foo/bar
      command: ["kubelet"]
      args: ["--feature-gates=RotateKubeletServerCertificate=false"]
  restartPolicy: OnFailure

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container7
      image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
      command: ["kube-controller-manager"]
      args: ["--feature-gates=RotateKubeletServerCertificate=false"]
  restartPolicy: OnFailure