KSPM failed findings, section "Kubelet" (21 = 7 rules x 3 nodes), evaluated 2026-11-11.
Resource type: process, resource name: kubelet. Benchmark: CIS Kubernetes v1.0.1 (K8s V1.23 edition).
Node IDs: fbd5af7d-693d-59f6-b331-bc3c43e0fcac, c7286ffa-1926-544d-8fed-36cc111c078c, 6077fdb5-0037-5c51-bfa8-f70ce200bc72

4.2.1  Ensure that the --anonymous-auth argument is set to false
4.2.2  Ensure that the --authorization-mode argument is not set to AlwaysAllow
4.2.3  Ensure that the --client-ca-file argument is set as appropriate
4.2.4  Verify that the --read-only-port argument is set to 0
4.2.6  Ensure that the --protect-kernel-defaults argument is set to true
4.2.9  Ensure that the --event-qps argument is set to 0 or a level which ensures appropriate event capture
4.2.10 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate

4.2.3 remediation (from flyout): kubelet config `authentication: x509: clientCAFile: <path>`,
or edit /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and restart kubelet.

CSPM (AWS) failed findings by section: Networking 34, Monitoring 32, Logging 19, EC2 17, IAM 16, S3 3 (=121).
Monitoring = CIS AWS 4.16 "Ensure AWS Security Hub is enabled", one failure per region (32 regions).
IAM = 1.12 (creds unused >=45d disabled), 1.13 (only one active access key per user), 1.14 (keys rotated <=90d). REDACT user names.

Finding document (JSON tab, 4.2.3 on node pool-4gb-3ed7ow), fields observed:
  agent.type = "cloudbeat"   agent.version = "9.5.6"   agent.name = "pool-4gb-3ed7ow"
  process.args = ["/usr/bin/kubelet", "--config=/etc/kubernetes/kubelet.conf",
                  "--kubeconfig=/etc/kubernetes/kubelet.kubeconfig",
                  "--bootstrap-kubeconfig=/etc/kubernetes/bootstrap.kubeconfig",
                  "--node-labels=doks.digitalocean.com/image-variant=base,doks...."]
  => cloudbeat evaluates the Kubelet 4.2.x rules from the running process args + the kubelet config file.