> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OCI OKE Kubelet Server Certificates Should Be Auto-Rotated

### More Info:

Kubelet server certificates should be rotated automatically (via RotateKubeletServerCertificate) so kubelets serving cert is short-lived and approved by the API server, reducing the window of misuse for stolen serving keys.

### Risk Level

Medium

### Address

Compliance, Security

### Compliance Standards

* CIS OKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        Below are step‑by‑step remediation steps using the **OCI Console** to ensure **kubelet server certificates are auto‑rotated for OKE node pools**.

        > Prerequisites
        >
        > * You must have permissions to manage OKE clusters and node pools in the target compartment.
        > * The cluster/node pool must be on a Kubernetes version that supports kubelet certificate rotation (all recent OKE versions do).

        ***

        ### 1. Identify the OKE cluster and node pools

        1. In the OCI Console, open the **Navigation menu** (≡).
        2. Go to **Developer Services** → **Kubernetes Clusters (OKE)**.
        3. Choose the appropriate **Compartment** from the left-side compartment selector.
        4. Click the **Cluster** that corresponds to the misconfiguration finding.
        5. In the cluster details page, go to the **Node Pools** tab.
        6. Identify the node pool(s) associated with the finding (usually all worker node pools should have rotation enabled).

        ***

        ### 2. Edit the node pool to enable kubelet certificate auto‑rotation

        You must do this for **each** node pool that does not have auto‑rotation enabled.

        1. In the **Node Pools** tab, click the **name** of the node pool you want to fix.
        2. On the node pool details page, click **Edit** (or **Update Node Pool**).
        3. In the edit form, look for a setting similar to:
           * **Kubelet certificate rotation**
           * or **Auto-rotate kubelet certificates**
        4. Enable this setting by checking the box or setting the toggle to **On / Enabled**.
        5. Review other configuration fields to ensure nothing else is unintentionally changed.
        6. Click **Save changes** / **Update**.

        OCI will apply the updated configuration to the node pool. Depending on version and settings, nodes may be **recreated or drained/updated**, so plan to do this during a maintenance window if you have strict availability requirements.

        ***

        ### 3. Repeat for all node pools in the cluster

        1. Go back to the **Node Pools** list for the cluster.
        2. Repeat the “Edit node pool” steps for every remaining node pool that does **not** have kubelet certificate rotation enabled.

        ***

        ### 4. Verify that kubelet certificate rotation is enabled

        1. After updates complete, return to each **Node Pool** details page.
        2. Confirm that the **Kubelet certificate rotation** (or similarly named) field is shown as **Enabled**.
        3. Optionally, validate from a node:
           * SSH or use `kubectl debug` to access a node.
           * Check kubelet configuration (e.g., kubelet service or config file) to verify certificate rotation flags are present (implementation detail; optional for compliance).

        ***

        ### 5. Re-scan / re-run compliance check

        After the configuration is updated and node pools finish updating:

        1. Trigger a new scan in your security/compliance tool (Cloud Guard, third‑party CSPM, etc.).
        2. Confirm that the finding **“OCI OKE Kubelet Server Certificates Should Be Auto-Rotated”** is now marked as **resolved** for that cluster/node pool.
      </Accordion>

      <Accordion title="Using CLI">
        For OKE today, kubelet server certificate rotation is controlled at the **cluster level** by the “Auto-Rotate Kubernetes Certificates” setting. As of the latest OKE / OCI CLI versions, that specific toggle is **only exposed in the Console and REST API**, not as a dedicated boolean flag in `oci ce cluster update`.

        So you cannot (yet) flip just that setting with a simple `oci ce ... --is-auto-rotate-...` style flag. You have two realistic options:

        ***

        ## 1. Use the OKE API via `oci raw-request` (CLI wrapper around REST)

        This keeps everything in OCI CLI, but calls the underlying Container Engine REST API directly.

        ### 1.1. Get cluster details to see current configuration

        ```bash theme={null}
        CLUSTER_OCID="<your_cluster_ocid>"

        oci ce cluster get \
          --cluster-id "$CLUSTER_OCID" \
          --output json > cluster-current.json
        ```

        Inspect `cluster-current.json` so you can see the current `clusterOptions` (or similarly named) block and confirm whether there is a field related to Kubernetes certificate rotation (name can vary by release – examples like `isKubernetesCertificatesAutoRotationEnabled` or similar).

        ### 1.2. Build the update payload

        Create a minimal JSON file, e.g. `cluster-update.json`, reusing the current values and only toggling the certificate rotation setting. **Do not drop required fields** such as `name`, `kubernetesVersion`, etc., as the update is usually PATCH-like but still field-sensitive.

        Example structure (you must match the exact field names from your `cluster-current.json`):

        ```json theme={null}
        {
          "name": "my-oke-cluster",
          "kubernetesVersion": "v1.29.1", 
          "clusterOptions": {
            "isKubernetesDashboardEnabled": false,
            "isTillerEnabled": false,
            "isKubernetesCertificatesAutoRotationEnabled": true
          }
        }
        ```

        Replace `isKubernetesCertificatesAutoRotationEnabled` with the **exact** property name visible in your current cluster JSON.

        ### 1.3. Call the OKE UpdateCluster API via `oci raw-request`

        1. Get the region and tenancy details (if not set already in your CLI profile):

           ```bash theme={null}
           REGION=$(oci configure get region)
           TENANCY_OCID=$(oci iam compartment list --all | jq -r '.data[0]."compartment-id"' | head -n1)
           ```

        2. Call the update API endpoint:

           ```bash theme={null}
           CLUSTER_OCID="<your_cluster_ocid>"

           oci raw-request \
             --http-method PUT \
             --target-uri "https://containerengine.${REGION}.oci.oraclecloud.com/20180222/clusters/${CLUSTER_OCID}" \
             --request-body file://cluster-update.json \
             --include-signing-headers
           ```

        3. Wait for the work request to finish:

           ```bash theme={null}
           WORK_REQUEST_ID=$(jq -r '.headers."opc-work-request-id"[0]' <<< "$(oci ce cluster get --cluster-id "$CLUSTER_OCID")")

           oci ce work-request get \
             --work-request-id "$WORK_REQUEST_ID"
           ```

        Once completed, kubelet certificates should be on **auto-rotation** for that cluster.

        ***

        ## 2. If you can relax the “OCI CLI only” constraint

        If strict “CLI only” is not mandatory, the supported and simpler way is:

        1. Go to: Developer Services → Kubernetes Clusters (OKE).
        2. Select the cluster.
        3. Click **Edit cluster**.
        4. Enable **Auto-Rotate Kubernetes Certificates**.
        5. Save changes and wait for the update to complete.

        ***

        ### Key points for your remediation policy

        * Scope: This is a **cluster-level** setting affecting kubelet / Kubernetes certificates for nodes in that cluster.
        * Enforcement: For compliance-as-code, wrap the `oci raw-request` approach in a script or use Terraform/Resource Manager:
          * Ensure all new clusters have certificate auto-rotation enabled.
          * Periodically scan and patch any cluster where the field is `false`.

        If you paste the `cluster-current.json` (with sensitive OCIDs redacted), I can show you the exact JSON and `oci raw-request` command specific to your OKE version.
      </Accordion>

      <Accordion title="Using Python">
        For OKE, kubelet certificate rotation is controlled at the cluster configuration level. The remediation is:

        1. Ensure the cluster has kubelet certificate rotation enabled.
        2. If the current OKE version/SDK supports toggling it on an existing cluster, update the cluster.
        3. If not supported for your cluster version, recreate the cluster with the setting enabled.

        Below is how to approach it with the OCI Python SDK.

        ***

        ## 1. Prerequisites

        * `oci` Python SDK installed:
          ```bash theme={null}
          pip install oci
          ```
        * OCI config file set up (usually `~/.oci/config`) with:
          * tenancy
          * user
          * fingerprint
          * key\_file
          * region
        * The OCID of the OKE cluster you want to remediate.

        ***

        ## 2. Inspect SDK Models to Find the Kubelet Config Flag

        Because OCI’s API models evolve, you should first introspect which model field is available in your SDK version for kubelet certificate rotation.

        Run this small helper once in a Python shell:

        ```python theme={null}
        import oci
        from pprint import pprint

        # List container engine models to discover the right one
        import oci.container_engine.models as models

        for name in dir(models):
            if "kubelet" in name.lower() or "certificate" in name.lower():
                print(name)
        ```

        Look for classes/fields similar to:

        * `KubeletConfig`
        * `UpdateClusterKubeletConfigDetails`
        * A boolean named like `is_kubelet_certificate_rotation_enabled` in any of the `*Cluster*Options*` models.

        Then inspect the candidate model:

        ```python theme={null}
        print(models.KubeletConfig.swagger_types)  # or whatever class you find
        ```

        You’re looking for a boolean field that clearly enables kubelet certificate rotation, commonly named close to `is_kubelet_certificate_rotation_enabled`.

        ***

        ## 3. Example: Updating an Existing Cluster (If Supported)

        Below is **template code** showing the pattern. You must plug in the exact model and field name you discovered in step 2.

        ```python theme={null}
        import oci
        from oci.container_engine import ContainerEngineClient
        import oci.container_engine.models as models

        # 1. Load config and client
        config = oci.config.from_file("~/.oci/config", "DEFAULT")
        ce_client = ContainerEngineClient(config)

        cluster_id = "ocid1.cluster.oc1...."  # your cluster OCID

        # 2. Get current cluster details (optional, but good to confirm)
        cluster = ce_client.get_cluster(cluster_id).data
        print("Current cluster lifecycle state:", cluster.lifecycle_state)

        # 3. Build the kubelet config object with cert rotation enabled.
        # Replace KubeletConfig and field name with what you found in step 2.
        kubelet_config = models.KubeletConfig(
            is_kubelet_certificate_rotation_enabled=True
        )

        # 4. Depending on SDK version, kubelet config may be nested in “options”
        # or a dedicated field in UpdateClusterDetails. Two common patterns:

        # Pattern A: Kubelet config inside UpdateClusterOptionsDetails
        cluster_options = models.UpdateClusterOptionsDetails(
            kubelet_config=kubelet_config
        )

        update_details = models.UpdateClusterDetails(
            options=cluster_options
        )

        # OR Pattern B: Kubelet config directly on UpdateClusterDetails
        # update_details = models.UpdateClusterDetails(
        #     kubelet_config=kubelet_config
        # )

        # 5. Call update_cluster
        response = ce_client.update_cluster(
            cluster_id=cluster_id,
            update_cluster_details=update_details
        )

        work_request_id = response.headers["opc-work-request-id"]
        print("Update requested. Work request ID:", work_request_id)

        # 6. Optionally wait for completion
        wr_client = oci.work_requests.WorkRequestClient(config)
        oci.work_requests.work_request.wait_on_work_request(
            wr_client, work_request_id
        )
        print("Cluster update completed.")
        ```

        If your SDK surfaces the field in a slightly different location/name, adapt:

        * Different model name for options (e.g., `ClusterCreateOptions`, `UpdateClusterOptionsDetails`).
        * Direct field on `UpdateClusterDetails`.

        ***

        ## 4. If Your OKE/SDK Version Does Not Expose the Flag

        If you don’t find any kubelet‑related configuration model/field:

        1. It may be:
           * Already enabled by default for your cluster’s OKE version, or
           * Only configurable at *cluster creation time* in your region/version.

        2. In that case, the remediation path is:

           * Create a **new OKE cluster** via the Console or Python SDK, explicitly enabling kubelet certificate rotation during creation (look for the kubelet certificate rotation option in the Console or `CreateClusterDetails` options in the SDK).
           * Migrate workloads (namespaces, deployments, services) to the new cluster.
           * Decommission the old cluster.

        Creation pattern with Python is similar:

        ```python theme={null}
        # Pseudocode pattern, exact models/fields depend on SDK version
        kubelet_config = models.KubeletConfig(
            is_kubelet_certificate_rotation_enabled=True
        )

        cluster_options = models.CreateClusterOptionsDetails(
            kubelet_config=kubelet_config,
            # ...other options...
        )

        create_details = models.CreateClusterDetails(
            name="secure-cluster",
            compartment_id="ocid1.compartment.oc1....",
            vcn_id="ocid1.vcn.oc1....",
            kubernetes_version="vX.Y.Z",
            options=cluster_options,
            # ...other required fields...
        )

        resp = ce_client.create_cluster(create_details)
        print("Create cluster work request:", resp.headers["opc-work-request-id"])
        ```

        ***

        If you paste the `dir(models)` and `swagger_types` output for the kubelet-related models from your environment, I can give you an exact, concrete Python snippet for your specific SDK version.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # There is currently no Terraform argument on oci_containerengine_node_pool
        # (or related OKE resources) that enables or configures automatic
        # RotateKubeletServerCertificate for kubelet server certificates.

        # This control must be satisfied outside Terraform, using the Kubernetes
        # API / cluster configuration rather than the OCI OKE Terraform resources.

        # High‑level manual steps (cannot be expressed in Terraform):
        # 1. Ensure the kubelet on each node is started with the
        #    --feature-gates=RotateKubeletServerCertificate=true flag (or equivalent
        #    configuration, depending on the OKE/Kubernetes version).
        # 2. Ensure the Kubernetes API server is configured to approve the
        #    certificate rotation CSR automatically or via your chosen CSR approver.
        # 3. For existing nodes, trigger rotation (e.g., by restarting kubelets or
        #    using kubectl / cluster tooling that supports RotateKubeletServerCertificate).

        # Since there is no Terraform-exposed setting for kubelet server certificate
        # auto‑rotation on oci_containerengine_node_pool, terraform plan will show
        # no changes related to this control; verification must be done via
        # Kubernetes (e.g., inspecting kubelet config and CSR/certificate lifetimes).
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>