Back to Checks
kubernetes

Controller Manager pod has --root-ca-file argument set

controllermanager_root_ca_file_set
Service: controllermanagerSeverity: critical
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:Pod

Kubernetes Controller Manager uses --root-ca-file to reference a certificate bundle so pods get a ca.crt for validating the API server's TLS certificate.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a configured root CA, pods cannot reliably verify the API server, enabling on-path spoofing. This exposes API traffic and service account tokens, allowing session hijack, data exfiltration, and malicious config changes-compromising confidentiality and integrity, and potentially disrupting availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks controllermanager_root_ca_file_set

Recommendation

Set a trusted CA bundle via --root-ca-file on the controller manager to ensure verified TLS for in-cluster API calls. Use a cluster-controlled CA, rotate and monitor certificates, and keep the bundle aligned with the API server chain. Apply defense in depth and least privilege for service accounts.

Remediation

Other

1SSH to a control-plane node with sudo privileges
2Edit the static Pod manifest: /etc/kubernetes/manifests/kube-controller-manager.yaml
3In the kube-controller-manager container command list, add this flag:
4- --root-ca-file=/etc/kubernetes/pki/ca.crt
5Save the file; kubelet will automatically restart the Pod

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
    controllermanager_client,
)


class controllermanager_root_ca_file_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in controllermanager_client.controllermanager_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Controller Manager does not have the root CA file set in pod {pod.name}."
            for container in pod.containers.values():
                if "--root-ca-file=" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"Controller Manager has the root CA file set in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References