Back to Checks
kubernetes

API server pod has --kubelet-client-certificate and --kubelet-client-key arguments configured

apiserver_kubelet_tls_auth
Service: apiserverSeverity: critical
OfficialBuilt-inVerified
Categories:cluster-securityencryption
Resource Type:Pod

Kubernetes API server is configured to use TLS client certificates when communicating with kubelets via --kubelet-client-certificate and --kubelet-client-key.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without mTLS to kubelets, apiserver requests may be anonymous or weakly authenticated. Adversaries can abuse kubelet endpoints to:

  • Read logs and files (C)
  • Exec into pods (I)
  • Evict or disrupt pods (A) Enables lateral movement and workload tampering.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_kubelet_tls_auth

Recommendation

Enforce mutual TLS between apiserver and kubelets using a dedicated client certificate/key (--kubelet-client-certificate, --kubelet-client-key) signed by a trusted CA. Apply least privilege to kubelet authorization and disable anonymous access to strengthen defense-in-depth.

Remediation

Other

1SSH to the control plane node.
2Edit the API server static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3Under spec.containers[0].command add both flags (use existing certs in /etc/kubernetes/pki):
4--kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt
5--kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
6Save the file; the kubelet will automatically restart the API server with the new flags.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_kubelet_tls_auth(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"API Server has appropriate kubelet TLS authentication configured in pod {pod.name}."
            for container in pod.containers.values():
                if "--kubelet-client-certificate" not in str(
                    container.command
                ) and "--kubelet-client-key" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"API Server is missing kubelet TLS authentication arguments in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References