To fix CMP-2548

applications/openshift/controller/controller_rotate_kubelet_server_certs/rule.yml

@@ -39,7 +39,7 @@ rationale: |-
 
 severity: medium
 
-platform: not ocp4-on-hypershift-hosted
+platform: not ocp4-on-hypershift-hosted and (ocp4.12 or ocp4.13)
 
 ocil_clause: |-
     <tt>RotateKubeletServerCertificate</tt> argument is set to <tt>false</tt> in the
@@ -49,7 +49,7 @@ ocil: |-
     To verify that <tt>RotateKubeletServerCertificate</tt> is configured correctly,
     run the following command:
     <pre>$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["feature-gates"]'</pre>
-    The output should return <tt>RotateKubeletServerCertificate=true</tt>.
+    The output should return <tt>RotateKubeletServerCertificate=true</tt>
 
 identifiers:
     cce@ocp4: CCE-83730-2
@@ -58,11 +58,12 @@ warnings:
 - general: |-
     {{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}
 - functionality: |-
-    This recommendation only applies if you let kubelets get their
-    certificates from the API Server. In case your certificates come from an
-    outside Certificate Authority/tool (e.g. Vault) then you need to take care
-    of rotation yourself
-
+    In OpenShift 4, the kubelet certification rotation is enabled by default. 
+    Openshift v4 automatically generates a new kube-apiserver-to-kubelet-signer CA certificates at 292
+    days, removes old CA certificate after 365 days, and the kubelet-client, kubelet-server 
+    certs are auto-rotated once every month. Hence, this rule is deprecated and not-applicable. 
+    ref: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/security_and_compliance/certificate-types-and-descriptions#purpose-5
+
 references:
     nerc-cip: CIP-003-8 R4.2,CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R5.1,CIP-007-3 R6.1
     nist: CM-6,CM-6(1),SC-8,SC-8(1)

applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/4.12.yml

@@ -0,0 +1,2 @@
+---
+default_result: PASS

applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/4.13.yml

@@ -0,0 +1,2 @@
+---
+default_result: PASS

applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/e2e.yml

@@ -1,2 +1,2 @@
 ---
-default_result: PASS
+default_result: NOT-APPLICABLE