documentation_complete: true


{{%- if product == "eks" %}}
{{%- set kubeletconf_path = "/etc/kubernetes/kubelet/kubelet-config.json" %}}
{{%- else %}}
{{%- set kubeletconf_path = "/etc/kubernetes/kubelet.conf" %}}
{{%- endif %}}

platform: {{{ product }}}-node

title: 'kubelet - Enable Certificate Rotation'

description: |-
    To enable the kubelet to rotate client certificates, edit the kubelet configuration
    file <tt>{{{ kubeletconf_path }}}</tt>
    on the kubelet node(s) and set the below parameter:
    <pre>
    ...
    rotateCertificates: true
    ...
    </pre>

rationale: |-
    Allowing the kubelet to auto-update the certificates ensure that there is no downtime
    in certificate renewal as well as ensures confidentiality and integrity.

severity: medium

ocil_clause: 'the kubelet cannot rotate client certificate'

ocil: |-
    Run the following command on the kubelet node(s):
    <pre>$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep rotateCertificates; done</pre>
    The output should return nothing or <tt>true</tt>.

identifiers:
    cce@ocp4: CCE-83838-3

references:
    cis@eks: 3.2.10
    cis@ocp4: 4.2.10
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

template:
    name: yamlfile_value
    vars:
        filepath: '/etc/kubernetes/compliance-operator/kubeletconfig/openscap-kubeletconfig'
        yamlpath: ".kubeletconfig.rotateCertificates"
        check_existence: "all_exist"
        values:
         - value: "true"
           operation: "equals"
