4212-k8s-kubelet-rotate-ca-Ensure kubelet client certificate rotation is enabled¶

Rule ID¶

• 4212-k8s-kubelet-rotate-ca

Category¶

• Container

Severity¶

• Info

Compatible Versions¶

• Linux

Description¶

• Enable kubelet client certificate rotation

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• Enables kubelet to replace its client certificate by creating a new CSR when the existing certificate expires, ensuring the cluster remains available and solving certificate availability issues.

Risk Item¶

• Container Security

Audit Method¶

• Run the following command to verify:

  ps -ef | grep kubelet | grep RotateKubeletServerCertificate
  

Remediation¶

• The kubelet version must be at least v1.16.0. Execute the following command:

  #> vim /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
  

  Set or add the parameter --RotateKubeletServerCertificate=true or remove --RotateKubeletServerCertificate=false.

Impact¶

• You must reconfigure the certificate parameters to ensure the security and availability of the kubelet.

Default Value¶

• By default: --RotateKubeletServerCertificate=true

References¶

• kubelet
• kubelet-configuration

CIS Controls¶

• None