4210-k8s-kubelet-tls-Set TLS connection on Kubernetes system¶

Rule ID¶

• 4210-k8s-kubelet-tls

Category¶

• container

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• None

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Failing to set up a TLS connection may cause insecure operation on untrusted and/or public networks, making it vulnerable to man-in-the-middle attacks. You can set --tls-cert-file=<path/to/tls-certificate-file> and --tls-private-key-file=<path/to/tls-key-file>.

Risk Items¶

• Container Security

Audit Procedure¶

• Run the following command to verify:

  ps -ef | grep kubelet
  

Remediation¶

• The kubelet version must not be lower than v1.16.0. Run the following command:

  #> vim /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
  

  Set or add the parameters --tls-cert-file and --tls-private-key-file. Note: If the --tls-cert-file parameter exists, set it to the corresponding CA file path. If this parameter does not exist, check the file configured by the -config parameter when starting kubelet, and check the configuration items tlsCertFile and tlsPrivateKeyFile in the file, and set them to the corresponding file paths. If the kubelet server is started via command line, the configuration specified by -config takes precedence.

After setting these parameters and ensuring they are correct, restart kubelet. Example: ```bash systemctl daemon-reload systemctl restart kubelet.service

Impact¶

• None

Default Value¶

• By default: certificate locations are not configured

References¶

• kubelet

CIS Controls¶

• None