Kubelet client periodic certificate switch disabled 이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다. Id: kubernetes-kubelet-client-periodic-certificate-switch-disabled
Platform: Kubernetes
Severity: Medium
Category: Secret Management
Learn More Description The kubelet argument --rotate-certificates should be set to true.
This rule flags kubelet containers (containers or initContainers) whose command is kubelet and include --rotate-certificates=false, and KubeletConfiguration resources where rotateCertificates is false or not set (default is false).
Enabling certificate rotation allows automatic renewal of kubelet client certificates and prevents certificate expiration-related failures.
Compliant Code Examples apiVersion : v1
kind : Pod
metadata :
name : command-demo
labels :
purpose : demonstrate-command
spec :
containers :
- name : command-demo-container
image : foo/bar
command : [ "kubelet" ]
args : [ "--rotate-certificates" ]
restartPolicy : OnFailure
apiVersion : kubelet.config.k8s.io/v1beta1
kind : KubeletConfiguration
address : "192.168.0.8"
port : 20250
serializeImagePulls : false
evictionHard :
memory.available : "200Mi"
rotateCertificates : true
Non-Compliant Code Examples apiVersion : v1
kind : Pod
metadata :
name : command-demo
labels :
purpose : demonstrate-command
spec :
containers :
- name : command-demo-container
image : foo/bar
command : [ "kubelet" ]
args : [ "--rotate-certificates=false" ]
restartPolicy : OnFailure
apiVersion : kubelet.config.k8s.io/v1beta1
kind : KubeletConfiguration
address : "192.168.0.8"
port : 20250
serializeImagePulls : false
evictionHard :
memory.available : "200Mi"
rotateCertificates : false
apiVersion : kubelet.config.k8s.io/v1beta1
kind : KubeletConfiguration
address : "192.168.0.8"
port : 20250
serializeImagePulls : false
evictionHard :
memory.available : "200Mi"
