-
Notifications
You must be signed in to change notification settings - Fork 685
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CMP-2365: Fix check for rotating kubelet server certificates #11543
CMP-2365: Fix check for rotating kubelet server certificates #11543
Conversation
The controller_rotate_kubelet_server_certs rule was only checking that RotateKubeletServerCertificate was enabled by making sure it's enabled explicitly. This doesn't work for clusters that are relying on the fact that RotateKubeletServerCertificate is enabled by default. This commit updates the check to invert the logic, so we're checking that it's not explicitly disabled.
/test |
@rhmdnd: The
Use
In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
/test e2e-aws-ocp4-moderate |
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_controller_rotate_kubelet_server_certs'.
--- xccdf_org.ssgproject.content_rule_controller_rotate_kubelet_server_certs
+++ xccdf_org.ssgproject.content_rule_controller_rotate_kubelet_server_certs
@@ -15,6 +15,9 @@
"RotateKubeletServerCertificate=true",
...
...
+
+
+This feature gate is enabled by default as of Kubernetes 1.12.
[warning]:
This rule's check operates on the cluster configuration dump. |
Code Climate has analyzed commit 9a63a69 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.3% (0.0% change). View more on Code Climate. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
The controller_rotate_kubelet_server_certs rule was only checking that
RotateKubeletServerCertificate was enabled by making sure it's enabled
explicitly. This doesn't work for clusters that are relying on the fact
that RotateKubeletServerCertificate is enabled by default.
This commit updates the check to invert the logic, so we're checking
that it's not explicitly disabled.