documentation_complete: true


{{%- if product == "eks" %}}
{{%- set kubeletconf_path = "/etc/kubernetes/kubelet/kubelet-config.json" %}}
{{%- else %}}
{{%- set kubeletconf_path = "/etc/kubernetes/kubelet.conf" %}}
{{%- endif %}}

platform: {{{ product }}}-node

title: 'kubelet - Enable Server Certificate Rotation'

description: |-
    To enable the kubelet to rotate server certificates, edit the kubelet configuration
    file <tt>{{{ kubeletconf_path }}}</tt>
    on the kubelet node(s) and set the below parameter:
    <pre>
    serverTLSBootstrap: true
    </pre>

rationale: |-
    Allowing the kubelet to auto-update the certificates ensure that there is no downtime
    in certificate renewal as well as ensures confidentiality and integrity.

severity: medium

ocil_clause: 'the kubelet cannot rotate server certificate'

ocil: |-
    Run the following command on the kubelet node(s):
    <pre>$ for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig.serverTLSBootstrap'; done</pre>
    The output should return <tt>true</tt>.

identifiers:
    cce@ocp4: CCE-83356-6

references:
    cis@eks: 3.2.11
    cis@ocp4: 4.2.11
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

template:
    name: yamlfile_value
    vars:
        filepath: '/etc/kubernetes/compliance-operator/kubeletconfig/openscap-kubeletconfig'
        yamlpath: ".kubeletconfig.serverTLSBootstrap"
        values:
         - value: "true"
           operation: "equals"
