OCI OKE Kubelet Server Certificates Should Be Auto-Rotated

Using Console

Below are step‑by‑step remediation steps using the OCI Console to ensure kubelet server certificates are auto‑rotated for OKE node pools.

Prerequisites

You must have permissions to manage OKE clusters and node pools in the target compartment.

The cluster/node pool must be on a Kubernetes version that supports kubelet certificate rotation (all recent OKE versions do).

1. Identify the OKE cluster and node pools

In the OCI Console, open the Navigation menu (≡).
Go to Developer Services → Kubernetes Clusters (OKE).
Choose the appropriate Compartment from the left-side compartment selector.
Click the Cluster that corresponds to the misconfiguration finding.
In the cluster details page, go to the Node Pools tab.
Identify the node pool(s) associated with the finding (usually all worker node pools should have rotation enabled).

2. Edit the node pool to enable kubelet certificate auto‑rotation

You must do this for each node pool that does not have auto‑rotation enabled.

In the Node Pools tab, click the name of the node pool you want to fix.
On the node pool details page, click Edit (or Update Node Pool).
In the edit form, look for a setting similar to:
- Kubelet certificate rotation
- or Auto-rotate kubelet certificates
Enable this setting by checking the box or setting the toggle to On / Enabled.
Review other configuration fields to ensure nothing else is unintentionally changed.
Click Save changes / Update.

OCI will apply the updated configuration to the node pool. Depending on version and settings, nodes may be recreated or drained/updated, so plan to do this during a maintenance window if you have strict availability requirements.

3. Repeat for all node pools in the cluster

Go back to the Node Pools list for the cluster.
Repeat the “Edit node pool” steps for every remaining node pool that does not have kubelet certificate rotation enabled.

4. Verify that kubelet certificate rotation is enabled

After updates complete, return to each Node Pool details page.
Confirm that the Kubelet certificate rotation (or similarly named) field is shown as Enabled.
Optionally, validate from a node:
- SSH or use kubectl debug to access a node.
- Check kubelet configuration (e.g., kubelet service or config file) to verify certificate rotation flags are present (implementation detail; optional for compliance).

5. Re-scan / re-run compliance check

After the configuration is updated and node pools finish updating:

Trigger a new scan in your security/compliance tool (Cloud Guard, third‑party CSPM, etc.).
Confirm that the finding “OCI OKE Kubelet Server Certificates Should Be Auto-Rotated” is now marked as resolved for that cluster/node pool.

Using CLI

For OKE today, kubelet server certificate rotation is controlled at the cluster level by the “Auto-Rotate Kubernetes Certificates” setting. As of the latest OKE / OCI CLI versions, that specific toggle is only exposed in the Console and REST API, not as a dedicated boolean flag in oci ce cluster update.So you cannot (yet) flip just that setting with a simple oci ce ... --is-auto-rotate-... style flag. You have two realistic options:

1. Use the OKE API via `oci raw-request` (CLI wrapper around REST)

This keeps everything in OCI CLI, but calls the underlying Container Engine REST API directly.

1.1. Get cluster details to see current configuration

CLUSTER_OCID="<your_cluster_ocid>"

oci ce cluster get \
  --cluster-id "$CLUSTER_OCID" \
  --output json > cluster-current.json

Inspect cluster-current.json so you can see the current clusterOptions (or similarly named) block and confirm whether there is a field related to Kubernetes certificate rotation (name can vary by release – examples like isKubernetesCertificatesAutoRotationEnabled or similar).

1.2. Build the update payload

Create a minimal JSON file, e.g. cluster-update.json, reusing the current values and only toggling the certificate rotation setting. Do not drop required fields such as name, kubernetesVersion, etc., as the update is usually PATCH-like but still field-sensitive.Example structure (you must match the exact field names from your cluster-current.json):

{
  "name": "my-oke-cluster",
  "kubernetesVersion": "v1.29.1", 
  "clusterOptions": {
    "isKubernetesDashboardEnabled": false,
    "isTillerEnabled": false,
    "isKubernetesCertificatesAutoRotationEnabled": true
  }
}

Replace isKubernetesCertificatesAutoRotationEnabled with the exact property name visible in your current cluster JSON.

1.3. Call the OKE UpdateCluster API via `oci raw-request`

Get the region and tenancy details (if not set already in your CLI profile):

REGION=$(oci configure get region)
TENANCY_OCID=$(oci iam compartment list --all | jq -r '.data[0]."compartment-id"' | head -n1)

Call the update API endpoint:

CLUSTER_OCID="<your_cluster_ocid>"

oci raw-request \
  --http-method PUT \
  --target-uri "https://containerengine.${REGION}.oci.oraclecloud.com/20180222/clusters/${CLUSTER_OCID}" \
  --request-body file://cluster-update.json \
  --include-signing-headers

Wait for the work request to finish:

WORK_REQUEST_ID=$(jq -r '.headers."opc-work-request-id"[0]' <<< "$(oci ce cluster get --cluster-id "$CLUSTER_OCID")")

oci ce work-request get \
  --work-request-id "$WORK_REQUEST_ID"

Once completed, kubelet certificates should be on auto-rotation for that cluster.

2. If you can relax the “OCI CLI only” constraint

If strict “CLI only” is not mandatory, the supported and simpler way is:

Go to: Developer Services → Kubernetes Clusters (OKE).
Select the cluster.
Click Edit cluster.
Enable Auto-Rotate Kubernetes Certificates.
Save changes and wait for the update to complete.

Key points for your remediation policy

Scope: This is a cluster-level setting affecting kubelet / Kubernetes certificates for nodes in that cluster.
Enforcement: For compliance-as-code, wrap the oci raw-request approach in a script or use Terraform/Resource Manager:
- Ensure all new clusters have certificate auto-rotation enabled.
- Periodically scan and patch any cluster where the field is false.

If you paste the cluster-current.json (with sensitive OCIDs redacted), I can show you the exact JSON and oci raw-request command specific to your OKE version.

Using Python

For OKE, kubelet certificate rotation is controlled at the cluster configuration level. The remediation is:

Ensure the cluster has kubelet certificate rotation enabled.
If the current OKE version/SDK supports toggling it on an existing cluster, update the cluster.
If not supported for your cluster version, recreate the cluster with the setting enabled.

Below is how to approach it with the OCI Python SDK.

1. Prerequisites

oci Python SDK installed:
pip install oci
OCI config file set up (usually ~/.oci/config) with:
- tenancy
- user
- fingerprint
- key_file
- region
The OCID of the OKE cluster you want to remediate.

2. Inspect SDK Models to Find the Kubelet Config Flag

Because OCI’s API models evolve, you should first introspect which model field is available in your SDK version for kubelet certificate rotation.Run this small helper once in a Python shell:

import oci
from pprint import pprint

# List container engine models to discover the right one
import oci.container_engine.models as models

for name in dir(models):
    if "kubelet" in name.lower() or "certificate" in name.lower():
        print(name)

Look for classes/fields similar to:

KubeletConfig
UpdateClusterKubeletConfigDetails
A boolean named like is_kubelet_certificate_rotation_enabled in any of the *Cluster*Options* models.

Then inspect the candidate model:

print(models.KubeletConfig.swagger_types)  # or whatever class you find

You’re looking for a boolean field that clearly enables kubelet certificate rotation, commonly named close to is_kubelet_certificate_rotation_enabled.

3. Example: Updating an Existing Cluster (If Supported)

Below is template code showing the pattern. You must plug in the exact model and field name you discovered in step 2.

import oci
from oci.container_engine import ContainerEngineClient
import oci.container_engine.models as models

# 1. Load config and client
config = oci.config.from_file("~/.oci/config", "DEFAULT")
ce_client = ContainerEngineClient(config)

cluster_id = "ocid1.cluster.oc1...."  # your cluster OCID

# 2. Get current cluster details (optional, but good to confirm)
cluster = ce_client.get_cluster(cluster_id).data
print("Current cluster lifecycle state:", cluster.lifecycle_state)

# 3. Build the kubelet config object with cert rotation enabled.
# Replace KubeletConfig and field name with what you found in step 2.
kubelet_config = models.KubeletConfig(
    is_kubelet_certificate_rotation_enabled=True
)

# 4. Depending on SDK version, kubelet config may be nested in “options”
# or a dedicated field in UpdateClusterDetails. Two common patterns:

# Pattern A: Kubelet config inside UpdateClusterOptionsDetails
cluster_options = models.UpdateClusterOptionsDetails(
    kubelet_config=kubelet_config
)

update_details = models.UpdateClusterDetails(
    options=cluster_options
)

# OR Pattern B: Kubelet config directly on UpdateClusterDetails
# update_details = models.UpdateClusterDetails(
#     kubelet_config=kubelet_config
# )

# 5. Call update_cluster
response = ce_client.update_cluster(
    cluster_id=cluster_id,
    update_cluster_details=update_details
)

work_request_id = response.headers["opc-work-request-id"]
print("Update requested. Work request ID:", work_request_id)

# 6. Optionally wait for completion
wr_client = oci.work_requests.WorkRequestClient(config)
oci.work_requests.work_request.wait_on_work_request(
    wr_client, work_request_id
)
print("Cluster update completed.")

If your SDK surfaces the field in a slightly different location/name, adapt:

Different model name for options (e.g., ClusterCreateOptions, UpdateClusterOptionsDetails).
Direct field on UpdateClusterDetails.

4. If Your OKE/SDK Version Does Not Expose the Flag

If you don’t find any kubelet‑related configuration model/field:

It may be:
- Already enabled by default for your cluster’s OKE version, or
- Only configurable at cluster creation time in your region/version.
In that case, the remediation path is:
- Create a new OKE cluster via the Console or Python SDK, explicitly enabling kubelet certificate rotation during creation (look for the kubelet certificate rotation option in the Console or CreateClusterDetails options in the SDK).
- Migrate workloads (namespaces, deployments, services) to the new cluster.
- Decommission the old cluster.

Creation pattern with Python is similar:

# Pseudocode pattern, exact models/fields depend on SDK version
kubelet_config = models.KubeletConfig(
    is_kubelet_certificate_rotation_enabled=True
)

cluster_options = models.CreateClusterOptionsDetails(
    kubelet_config=kubelet_config,
    # ...other options...
)

create_details = models.CreateClusterDetails(
    name="secure-cluster",
    compartment_id="ocid1.compartment.oc1....",
    vcn_id="ocid1.vcn.oc1....",
    kubernetes_version="vX.Y.Z",
    options=cluster_options,
    # ...other required fields...
)

resp = ce_client.create_cluster(create_details)
print("Create cluster work request:", resp.headers["opc-work-request-id"])

If you paste the dir(models) and swagger_types output for the kubelet-related models from your environment, I can give you an exact, concrete Python snippet for your specific SDK version.

Using Terraform

# There is currently no Terraform argument on oci_containerengine_node_pool
# (or related OKE resources) that enables or configures automatic
# RotateKubeletServerCertificate for kubelet server certificates.

# This control must be satisfied outside Terraform, using the Kubernetes
# API / cluster configuration rather than the OCI OKE Terraform resources.

# High‑level manual steps (cannot be expressed in Terraform):
# 1. Ensure the kubelet on each node is started with the
#    --feature-gates=RotateKubeletServerCertificate=true flag (or equivalent
#    configuration, depending on the OKE/Kubernetes version).
# 2. Ensure the Kubernetes API server is configured to approve the
#    certificate rotation CSR automatically or via your chosen CSR approver.
# 3. For existing nodes, trigger rotation (e.g., by restarting kubelets or
#    using kubectl / cluster tooling that supports RotateKubeletServerCertificate).

# Since there is no Terraform-exposed setting for kubelet server certificate
# auto‑rotation on oci_containerengine_node_pool, terraform plan will show
# no changes related to this control; verification must be done via
# Kubernetes (e.g., inspecting kubelet config and CSR/certificate lifetimes).

OCI Misconfigurations

OCI OKE Kubelet Server Certificates Should Be Auto-Rotated

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the OKE cluster and node pools

2. Edit the node pool to enable kubelet certificate auto‑rotation

3. Repeat for all node pools in the cluster

4. Verify that kubelet certificate rotation is enabled

5. Re-scan / re-run compliance check

1. Use the OKE API via `oci raw-request` (CLI wrapper around REST)

1.1. Get cluster details to see current configuration

1.2. Build the update payload

1.3. Call the OKE UpdateCluster API via `oci raw-request`

2. If you can relax the “OCI CLI only” constraint

Key points for your remediation policy

1. Prerequisites

2. Inspect SDK Models to Find the Kubelet Config Flag

3. Example: Updating an Existing Cluster (If Supported)

4. If Your OKE/SDK Version Does Not Expose the Flag

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​1. Identify the OKE cluster and node pools

​2. Edit the node pool to enable kubelet certificate auto‑rotation

​3. Repeat for all node pools in the cluster

​4. Verify that kubelet certificate rotation is enabled

​5. Re-scan / re-run compliance check

​1. Use the OKE API via oci raw-request (CLI wrapper around REST)

​1.1. Get cluster details to see current configuration

​1.2. Build the update payload

​1.3. Call the OKE UpdateCluster API via oci raw-request

​2. If you can relax the “OCI CLI only” constraint

​Key points for your remediation policy

​1. Prerequisites

​2. Inspect SDK Models to Find the Kubelet Config Flag

​3. Example: Updating an Existing Cluster (If Supported)

​4. If Your OKE/SDK Version Does Not Expose the Flag

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

1. Identify the OKE cluster and node pools

2. Edit the node pool to enable kubelet certificate auto‑rotation

3. Repeat for all node pools in the cluster

4. Verify that kubelet certificate rotation is enabled

5. Re-scan / re-run compliance check

1. Use the OKE API via `oci raw-request` (CLI wrapper around REST)

1.1. Get cluster details to see current configuration

1.2. Build the update payload

1.3. Call the OKE UpdateCluster API via `oci raw-request`

2. If you can relax the “OCI CLI only” constraint

Key points for your remediation policy

1. Prerequisites

2. Inspect SDK Models to Find the Kubelet Config Flag

3. Example: Updating an Existing Cluster (If Supported)

4. If Your OKE/SDK Version Does Not Expose the Flag