documentation_complete: true


title: 'Configure the kubelet Certificate File for the API Server'

{{% set default_jqfilter = '[.data."config.yaml" | fromjson | select(.apiServerArguments["kubelet-client-certificate"]) | .apiServerArguments["kubelet-client-certificate"][] | select(test("{{.var_apiserver_kubelet_client_cert}}"))]' %}}
{{% set default_api_path = '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' %}}
{{% set hypershift_path = '/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config' %}}
{{% set hypershift_jqfilter = '[.data."config.json" | fromjson | select(.apiServerArguments["kubelet-client-certificate"]) | .apiServerArguments["kubelet-client-certificate"][] | select(test("/etc/kubernetes/certs/kubelet/tls.crt"))]' %}}
{{% set custom_api_path = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_path ~ '{{else}}' ~  default_api_path ~ '{{end}}' %}}
{{% set custom_jqfilter = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_jqfilter ~ '{{else}}' ~  default_jqfilter ~ '{{end}}' %}}
{{% set dump_path = default_api_path ~ ',' ~ default_jqfilter ~ ',' ~ custom_jqfilter %}}

description: |-
    To enable certificate based kubelet authentication,
    edit the <tt>config</tt> configmap in the <tt>openshift-kube-apiserver</tt>
    namespace and set the below parameter in the <tt>config.yaml</tt> key if
    it is not already configured:
    <pre>
    "apiServerArguments":{
    ...
      "kubelet-client-certificate":"/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt",
    ...
    }
    </pre>

rationale: |-
    By default the API Server does not authenticate itself to the kubelet's
    HTTPS endpoints. Requests from the API Server are treated anonymously.
    Configuring certificate-based kubelet authentication ensures that the
    API Server authenticates itself to kubelets when submitting requests.

identifiers:
  cce@ocp4: CCE-84080-1

platform: not ocp4-on-hypershift-hosted

severity: high

references:
    cis@ocp4: 1.2.5
    nerc-cip: CIP-003-8 R4.2,CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R5.1,CIP-007-3 R6.1
    nist: CM-6,CM-6(1),SC-8,SC-8(1)
    pcidss: Req-2.2
    srg: SRG-APP-000516-CTR-001325

ocil_clause: '<tt>kubelet-client-certificate</tt> is not set as appropriate in <tt>apiServerArguments:</tt>'

ocil: |-
    Run the following command:
    <pre>$ oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.apiServerArguments["kubelet-client-certificate"]'</pre>
    The output should return <tt>/etc/kubernetes/static-pod-resources/secrets/kubelet-client/tls.crt</tt>
    or <tt>/etc/kubernetes/static-pod-certs/secrets/kubelet-client/tls.crt</tt>

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: {{{ openshift_filtered_path(default_api_path, default_jqfilter) }}}
    yamlpath: "[:]"
    check_existence: "at_least_one_exists"
    entity_check: "all"
    values:
      - value: "(.*?)"
        operation: "pattern match"
