Skip to content

CMP-4341: added kubernetes files#14804

Closed
vickeybrown wants to merge 1 commit into
ComplianceAsCode:masterfrom
vickeybrown:CMP-4341
Closed

CMP-4341: added kubernetes files#14804
vickeybrown wants to merge 1 commit into
ComplianceAsCode:masterfrom
vickeybrown:CMP-4341

Conversation

@vickeybrown

Copy link
Copy Markdown
Collaborator

Description:

  • Created Kubernetes remediation files for 4 kubelet security configuration rules:
    • kubelet_anonymous_auth: Disable anonymous authentication to the kubelet
    • kubelet_authorization_mode: Configure kubelet authorization mode
    • kubelet_configure_client_ca: Configure kubelet client certificate authority
    • kubelet_enable_server_cert_rotation: Enable kubelet server certificate rotation

Rationale:

  • These 4 kubelet rules previously had no automated Kubernetes/OpenShift remediations,
    requiring manual intervention to fix non-compliant configurations.

  • The remediation files use the kubelet_config_fixed macro to generate KubeletConfig
    objects that the Machine Config Operator can apply to OpenShift nodes.

  • This enables automated remediation of these security controls in OpenShift 4.x
    environments, improving compliance automation coverage.

  • Fixes CMP-4341

Review Hints:

  • Each remediation file follows the same pattern: using the kubelet_config_fixed
    macro to set specific kubelet configuration parameters via KubeletConfig custom
    resources.
  • You can verify the macro usage is correct by checking that the path, parameter,
    and value arguments match the kubelet configuration requirements described in each
    rule's rule.yml file.
  • To test locally, you can build the content and run compliance scans on an OpenShift
    4.x cluster to verify the remediations are generated and can be applied successfully.

@vickeybrown

Copy link
Copy Markdown
Collaborator Author

/test 4.22-e2e-aws-openshift-node-compliance-rhcos10

@vickeybrown

Copy link
Copy Markdown
Collaborator Author

/retest

@LuuOW LuuOW left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Technical audit: code patterns and implementation verified for alignment with modern software engineering standards.

@vickeybrown vickeybrown marked this pull request as draft June 17, 2026 14:25
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jun 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

do-not-merge/work-in-progress Used by openshift-ci bot.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants