Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

To fix CMP-2548 #12008

Merged
merged 6 commits into from
Jun 25, 2024
Merged

To fix CMP-2548 #12008

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a582345
To fix CMP-2548
rutvik23 May 20, 2024
651cfa9
modifying rule content and selection criteria
rutvik23 Jun 14, 2024
35f5869
adding warning section
rutvik23 Jun 17, 2024
028049f
fixing whitespaces in warning section
rutvik23 Jun 17, 2024
c378c08
updating platform check and tests
rutvik23 Jun 24, 2024
3beb2f6
fixing e2e assertions
rutvik23 Jun 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 8 additions & 6 deletions applications/openshift/controller/controller_rotate_kubelet_server_certs/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,19 +37,21 @@ rationale: |-
ensures that there are no downtimes due to expired certificates and thus
addressing the availability in the C/I/A security triad.

In OpenShift 4, the kubelete certification rotation is enabled by default, hence this check is not-applicable.
yuumasato marked this conversation as resolved.
Show resolved Hide resolved

severity: medium

platform: not ocp4-on-hypershift-hosted

ocil_clause: |-
<tt>RotateKubeletServerCertificate</tt> argument is set to <tt>false</tt> in the
<tt>controllerArguments</tt> options
<tt>serverTLSBootstrap</tt> argument is set to <tt>false</tt> in the
<tt>kubeletconfig</tt> options
rutvik23 marked this conversation as resolved.
Show resolved Hide resolved

ocil: |-
To verify that <tt>RotateKubeletServerCertificate</tt> is configured correctly,
run the following command:
<pre>$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["feature-gates"]'</pre>
The output should return <tt>RotateKubeletServerCertificate=true</tt>.
RotateKubeletServerCertificate is no longer a valid check, instead an user should run below commands and confirm the rotation settings are enabled as default.
<pre>$ for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig.serverTLSBootstrap'; done</pre>
<pre>$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep rotateCertificates; done</pre>
The output should return <tt>true</tt>
yuumasato marked this conversation as resolved.
Show resolved Hide resolved

identifiers:
cce@ocp4: CCE-83730-2
Expand Down
2 changes: 1 addition & 1 deletion applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
---
default_result: PASS
default_result: NOT-APPLICABLE
yuumasato marked this conversation as resolved.
Show resolved Hide resolved
Loading