cloudtaser-cli assess node-evidence¶
Run directly on the target Linux host through approved node access. Reads kernel metadata, standalone kubelet arguments and configured CNI plugin types. Tests memfd_secret with an empty anonymous fd, then closes it. No files, BPF, mounts, cluster objects or enforcement settings are changed. No kubeconfig is read. Output is a JSON array for assess --node-evidence; it is operator-supplied observation, not authenticated attestation. Run in the host namespaces, not a workload container. Embedded k3s kubelet arguments remain UNKNOWN.
Usage¶
Flags¶
| Flag | Type | Default | Required | Description |
|---|---|---|---|---|
--help, -h |
bool | false |
no | help for node-evidence |
--node |
string | (empty) |
no | exact Kubernetes node name |
--node-uid |
string | (empty) |
no | current Kubernetes Node UID |