Evaluating KubeletConfig rules against default configuration values
The Compliance Operator uses the Node/Proxy API to evaluate KubeletConfig object rules against actual node configurations, preventing inaccurate results caused by incomplete configuration files and default values for missing options.
Red Hat OpenShift Container Platform infrastructure might contain incomplete configuration files at run time, and nodes assume default configuration values for missing configuration options. Some configuration options can be passed as command-line arguments. As a result, the Compliance Operator cannot verify if the configuration file on the node is complete because it might be missing options used in the rule checks.
To prevent false negative results where the default configuration value passes a check, the Compliance Operator uses the Node/Proxy API to fetch the configuration for each node in a node pool, then all configuration options that are consistent across nodes in the node pool are stored in a file that represents the configuration for all nodes within that node pool. This increases the accuracy of the scan results.
No additional configuration changes are required to use this feature with default master and worker node pools configurations.