Back to Checks
kubernetes

API server pod has --tls-cert-file and --tls-private-key-file configured

apiserver_tls_config
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:Pod

Kubernetes API server configuration is checked for explicit TLS settings via --tls-cert-file and --tls-private-key-file. The presence of both flags indicates HTTPS is configured with a specified certificate and private key for client connections.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Improper or unmanaged TLS on the API endpoint can cause untrusted certs and verification bypass, enabling MITM to capture admin credentials or tokens and modify requests. This compromises confidentiality and integrity, and unexpected certificate expiry can affect availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_tls_config

Recommendation

Configure the API server to use TLS with a valid certificate and key via --tls-cert-file and --tls-private-key-file.

Use a trusted CA with correct SANs, restrict network access to the endpoint, and automate certificate rotation and expiry monitoring to uphold defense in depth and least privilege.

Remediation

Other

1SSH to each control-plane node
2Edit the API server static pod manifest:
3sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
4In spec.containers[0].command, add both flags:
5```
6- --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
7- --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
8```
9Save the file; the kubelet will automatically restart the API server

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_tls_config(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"TLS certificate and key are set appropriately in pod {pod.name}."
            )
            for container in pod.containers.values():
                # Check if both "--tls-cert-file" and "--tls-private-key-file" are set
                if "--tls-cert-file" not in str(
                    container.command
                ) or "--tls-private-key-file" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"TLS certificate and/or key are not set in pod {pod.name}."
                    )
                    break

            findings.append(report)
        return findings

References