diff --git a/applications/openshift/kubelet/kubelet_enable_server_cert_rotation/rule.yml b/applications/openshift/kubelet/kubelet_enable_server_cert_rotation/rule.yml index 519b98b7f5d8..9615b0a35179 100644 --- a/applications/openshift/kubelet/kubelet_enable_server_cert_rotation/rule.yml +++ b/applications/openshift/kubelet/kubelet_enable_server_cert_rotation/rule.yml @@ -17,10 +17,7 @@ description: |- file {{{ kubeletconf_path }}} on the kubelet node(s) and set the below parameter:
- featureGates:
- ...
- RotateKubeletServerCertificate: true
- ...
+ serverTLSBootstrap: true
rationale: |-
@@ -33,7 +30,7 @@ ocil_clause: 'the kubelet cannot rotate server certificate'
ocil: |-
Run the following command on the kubelet node(s):
- $ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletServerCertificate; done
+ $ for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig.serverTLSBootstrap'; done
The output should return true.
identifiers:
diff --git a/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_master/rule.yml b/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_master/rule.yml
index 5cbe36338766..f3571d2274e9 100644
--- a/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_master/rule.yml
+++ b/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_master/rule.yml
@@ -17,10 +17,7 @@ description: |-
file {{{ kubeletconf_path }}}
on the kubelet node(s) and set the below parameter:
- featureGates:
- ...
- RotateKubeletServerCertificate: true
- ...
+ serverTLSBootstrap: true
rationale: |-
@@ -33,7 +30,7 @@ ocil_clause: 'the kubelet cannot rotate server certificate'
ocil: |-
Run the following command on the kubelet node(s):
- $ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletServerCertificate; done
+ $ for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig.serverTLSBootstrap' done
The output should return true.
references:
@@ -49,7 +46,7 @@ template:
ocp_data: "true"
filepath: '/kubeletconfig/role'
filepath_suffix: var_role_master
- yamlpath: ".featureGates.RotateKubeletServerCertificate"
+ yamlpath: ".serverTLSBootstrap"
values:
- value: "true"
operation: "equals"
diff --git a/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_worker/rule.yml b/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_worker/rule.yml
index 88289a99b302..738b8db8a9a5 100644
--- a/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_worker/rule.yml
+++ b/applications/openshift/kubelet/kubelet_enable_server_cert_rotation_worker/rule.yml
@@ -17,10 +17,7 @@ description: |-
file {{{ kubeletconf_path }}}
on the kubelet node(s) and set the below parameter:
- featureGates:
- ...
- RotateKubeletServerCertificate: true
- ...
+ serverTLSBootstrap: true
rationale: |-
@@ -33,7 +30,7 @@ ocil_clause: 'the kubelet cannot rotate server certificate'
ocil: |-
Run the following command on the kubelet node(s):
- $ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep RotateKubeletServerCertificate; done
+ $ for node in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$node/proxy/configz | jq '.kubeletconfig.serverTLSBootstrap'; done
The output should return true.
references:
@@ -49,7 +46,7 @@ template:
ocp_data: "true"
filepath: '/kubeletconfig/role'
filepath_suffix: var_role_worker
- yamlpath: ".featureGates.RotateKubeletServerCertificate"
+ yamlpath: ".serverTLSBootstrap"
values:
- value: "true"
operation: "equals"