Back to Checks
kubernetes

API server pod has --kubelet-certificate-authority configured

apiserver_kubelet_cert_auth
Service: apiserverSeverity: critical
OfficialBuilt-inVerified
Categories:cluster-securityencryption
Resource Type:Pod

Kubernetes API server is configured with a kubelet certificate authority via --kubelet-certificate-authority so it can validate kubelet serving certificates during APIkubelet TLS connections.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a trusted kubelet CA, the API server can't verify kubelet identities, weakening TLS and enabling man-in-the-middle on control planenode traffic. Attackers could read logs/exec streams (Confidentiality), tamper with responses or commands (Integrity), and disrupt node management (Availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_kubelet_cert_auth

Recommendation

Enforce mutual TLS for API server-kubelet communication. Provide a trusted CA using --kubelet-certificate-authority, issue certs from controlled PKI, rotate keys, and limit client credentials per least privilege. Prefer private networking and layered controls for defense in depth.

Remediation

NativeIaC

# kube-apiserver Pod with kubelet CA configured
apiVersion: v1
kind: Pod
metadata:
  name: <example_resource_name>
  namespace: kube-system
spec:
  containers:
  - name: kube-apiserver
    image: registry.k8s.io/kube-apiserver:v1.27.0
    command:
    - kube-apiserver
    - --kubelet-certificate-authority=/etc/kubernetes/pki/ca.crt  # Critical: verifies kubelet certs using this CA to secure apiserver<->kubelet

Other

1SSH to the control-plane node
2Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3In containers[].command, add: --kubelet-certificate-authority=/etc/kubernetes/pki/ca.crt
4Save the file; the kubelet will restart the API server automatically
5Verify the flag is present in the manifest and the apiserver pod is Running in kube-system

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_kubelet_cert_auth(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"API Server has appropriate kubelet certificate authority configured in pod {pod.name}."
            for container in pod.containers.values():
                if "--kubelet-certificate-authority" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"API Server is missing kubelet certificate authority configuration in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References