Back to Checks
kubernetes

API server pod has the --client-ca-file argument set

apiserver_client_ca_file_set
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesscluster-security
Resource Type:Pod

Kubernetes API server uses a configured client CA (--client-ca-file) to validate x509 client certificates presented for API authentication

Prowler logoProwlerprowler-provider-kubernetes

Risk

Absent a client CA, the API server cannot validate x509 client identities, disabling mutual TLS.

This weakens authentication and can enable unauthorized reads or writes to cluster resources, impacting confidentiality and integrity, especially if other methods (e.g., anonymous or weak tokens) are misconfigured.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_client_ca_file_set

Recommendation

Establish a trusted client CA for the API server and require certificate-based client authentication. Combine with RBAC and least privilege, disable anonymous access, and enforce key rotation and auditing to provide defense in depth.

Remediation

Other

1SSH to each control-plane node
2Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3In the kube-apiserver container command, add this flag (use your CA path if different):
4```
5- --client-ca-file=/etc/kubernetes/pki/ca.crt
6```
7Save the file; the kubelet will restart the API server automatically

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_client_ca_file_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Client CA file is set appropriately in the API server in pod {pod.name}."
            client_ca_file_set = False
            for container in pod.containers.values():
                client_ca_file_set = False
                # Check if "--client-ca-file" is set
                if "--client-ca-file" in str(container.command):
                    client_ca_file_set = True
                if not client_ca_file_set:
                    break

            if not client_ca_file_set:
                report.status = "FAIL"
                report.status_extended = f"Client CA file is not set in pod {pod.name}."

            findings.append(report)
        return findings

References