4211-k8s-kubelet-rotate-Ensure the --rotate-certificates parameter is not set to false¶

Rule ID¶

• 4211-k8s-kubelet-rotate

Category¶

• container

Level¶

• info

Compatible Versions¶

• Linux

Description¶

• Enable kubelet client certificate rotation

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• This causes kubelet to replace its client certificate by creating a new CSR when the existing certificate expires, ensuring that cluster availability is not affected by certificate expiration, thereby addressing certificate usability.

Risk¶

• Container Security

Audit Method¶

• Run the following command to verify:

  ps -ef | grep kubelet | grep rotate-certificates
  

Remediation¶

• The kubelet version must be v1.16.0 or higher. Run the following command:

  #> vim /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
  

  Set or add the parameter --rotate-certificates=true or remove --rotate-certificates=false.

Impact¶

• You must reconfigure the certificate parameters to ensure the security and availability of the kubelet.

Default Value¶

• By default: --rotate-certificates=true

References¶

• kubelet
• kubelet-configuration

CIS Controls¶

• None