0423-k8s-client-ca-kubelet Ensure the client CA file parameter is set as needed¶

Rule ID¶

By default, Kubelet allows all authenticated requests (even anonymous requests) without requiring explicit authorization checks from the sender. You should restrict this behavior because it is not safe to run on untrusted and/or public networks.

Execute the following command to verify:

ps -ef | grep kubelet |grep client-ca-file

Execute the following command:
```
#> vim /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
```
Set --client-ca-file=<path/to/client-ca-file> Note: If the --client-ca-file parameter exists, set it to the corresponding CA file path. If this parameter does not exist, check the file specified by the -config parameter used to start kubelet, and check the configuration item authentication: x509: clientCAFile in the file, setting it to the corresponding file path. For kubelet servers started with command-line arguments, the configuration specified by -config takes precedence.

After setting these parameters and ensuring they are correct, restart kubelet:

systemctl daemon-reload
systemctl restart kubelet.service

You need to configure TLS on the API server. The certificate file path should theoretically be the local CA certificate, typically configured as: /etc/kubernetes/pki/ca.crt