Back to Checks
kubernetes

Controller Manager pod has RotateKubeletServerCertificate set to true

controllermanager_rotate_kubelet_server_cert
Service: controllermanagerSeverity: medium
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:Pod

Kubernetes controller manager configuration includes the RotateKubeletServerCertificate=true feature gate for automatic rotation of kubelet server certificates

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without certificate rotation, kubelet HTTPS endpoints can use expired or long-lived certs, triggering TLS failures and operational gaps. Teams may bypass verification, enabling MitM and tampering. This harms availability and integrity, and extends exposure if a private key is compromised.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks controllermanager_rotate_kubelet_server_cert

Recommendation

Enable RotateKubeletServerCertificate=true on the controller manager and ensure kubelets participate in rotation.

Use short-lived certs, automated renewal, and strict TLS validation to maintain availability, protect integrity, and uphold cryptographic hygiene. Avoid insecure fallbacks.

Remediation

Other

1SSH to a control-plane node and open the controller manager static pod manifest:
2- /etc/kubernetes/manifests/kube-controller-manager.yaml
3In spec.containers[0].command, add or update this flag:
4```
5--feature-gates=RotateKubeletServerCertificate=true
6```
7Save the file; the kubelet will automatically restart the pod with the updated setting.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
    controllermanager_client,
)


class controllermanager_rotate_kubelet_server_cert(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in controllermanager_client.controllermanager_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Controller Manager has RotateKubeletServerCertificate set to true in pod {pod.name}."
            kubelete_server_cert = True
            for container in pod.containers.values():
                kubelete_server_cert = True
                for command in container.command:
                    if command.startswith("--feature-gates"):
                        if "RotateKubeletServerCertificate=true" not in (
                            command.split("=")[1]
                        ):
                            kubelete_server_cert = False
                if not kubelete_server_cert:
                    break
            if not kubelete_server_cert:
                report.status = "FAIL"
                report.status_extended = f"Controller Manager does not have RotateKubeletServerCertificate set to true in pod {pod.name}."
            findings.append(report)
        return findings

References