🧹 k8s: use typed kubelet fields instead of raw configuration dict

[tas50]

What

Migrates the kubelet checks in mondoo-kubernetes-security off raw kubelet.configuration[...] dict walking to the typed kubelet accessors shipped in os-13.30.0 (mql #8612). The typed getters coerce both the config-file (native bool/int) and CLI-flag (string) forms and apply kubelet defaults, so the queries are shorter and more robust.

Field	Before	After
anonymous auth	configuration['authentication']['anonymous']['enabled'] == false	kubelet.anonymousAuthEnabled == false
event QPS	configuration['eventRecordQPS'] == 0	kubelet.eventRecordQPS == 0
iptables chains	configuration['makeIPTablesUtilChains'] == true	kubelet.makeIPTablesUtilChains == true
protect kernel	configuration["protectKernelDefaults"] == "true"	kubelet.protectKernelDefaults == true
read-only port	configuration['readOnlyPort'] == 0 || ... == null	kubelet.readOnlyPort == 0
authz mode	configuration['authorization']['mode'] != "AlwaysAllow"	kubelet.authorizationMode != "AlwaysAllow"
cipher suites	configuration['tlsCipherSuites']	kubelet.tlsCipherSuites
serving cert/key	configuration["tlsCertFile"] / ["tlsPrivateKeyFile"]	kubelet.tlsCertFile / kubelet.tlsPrivateKeyFile
rotate certs	configuration["rotateCertificates"] != "false"	kubelet.rotateCertificates == true
client CA	configuration['authentication']['x509']['clientCAFile']	kubelet.clientCAFile

⚠️ Two behavioral changes (not just cosmetic)

• protectKernelDefaults — the old == "true" string compare only matched the CLI-flag form; a node setting this via the config file (bool true) silently failed the check. The typed bool coerces both, fixing that false negative.
• rotateCertificates — the old != "false" passed when the field was absent. The typed bool resolves the effective default (false), so a node that is not actually rotating certificates now correctly fails. This is more security-correct but will newly flag nodes that previously relied on the lenient check. If we'd rather preserve the CIS-literal "not explicitly false" semantics, shout and I'll adjust.

readOnlyPort also drops its || == null guard — the typed getter always returns a normalized int (0 when unset/disabled).

Dependency

Requires the os-13.30.0 provider (mql #8612 / release #8644). Validated locally against that installed provider.

Testing

cnspec policy lint ./content/mondoo-kubernetes-security.mql.yaml → valid policy bundle.

🤖 Generated with Claude Code

[mondoo-code-review]

Clean migration from raw dict access to typed kubelet fields, with two semantic changes worth verifying.

[github-actions]

Test Results

  1 files  ±0   44 suites  ±0   1m 44s ⏱️ +5s
854 tests ±0  853 ✅ ±0  1 💤 ±0  0 ❌ ±0 
855 runs  ±0  854 ✅ ±0  1 💤 ±0  0 ❌ ±0 

Results for commit 9b46e57. ± Comparison against base commit 5c0d2f3.

♻️ This comment has been updated with latest results.

[mondoo-code-review]

Clean migration from raw dict access to typed fields with minor semantic changes worth verifying.

[tas50]

/review

[mondoo-code-review]

Clean migration from raw dict access to typed fields, with two semantic changes worth verifying.

[mondoo-code-review]

Clean migration from raw dict access to typed fields, with two behavioral changes worth verifying.

[mondoo-code-review]

Clean migration from raw config dict to typed fields with minor behavioral changes worth noting

[mondoo-code-review]

🟡 warning — The old check compared protectKernelDefaults against the string "true", but the new check compares against the boolean true. This is a semantic fix (the old check was likely a bug comparing a boolean field to a string), but verify that kubelet.protectKernelDefaults returns a boolean and not a string, otherwise this changes behavior.

[mondoo-code-review]

🟡 warning — The old check allowed both == 0 and == null (i.e., field not set). The new check only allows == 0. If kubelet.readOnlyPort returns null/nil when the field is unset, this will cause previously-passing checks to fail. Confirm that the typed field defaults to 0 when unset, or re-add the null check: kubelet.readOnlyPort == 0 || kubelet.readOnlyPort == null.

[mondoo-code-review]

🟡 warning — The old check was != "false" (pass if not explicitly disabled), but the new check is == true (pass only if explicitly enabled). This is stricter: if the field is unset/null, the old check would pass but the new one would fail. Verify this is the intended behavior, since the default for rotateCertificates in kubelet is true as of K8s 1.19+, so the typed field should reflect that default.