Back to Checks
kubernetes

Kubelet has a client CA file configured for authentication

kubelet_client_ca_file_set
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:ConfigMap

Kubernetes Kubelet is evaluated for X.509 client certificate authentication by checking if its config sets authentication.x509.clientCAFile to validate clients on the HTTPS endpoint.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a client CA, the kubelet cannot verify client certificates, weakening authentication. With network access, attackers could impersonate trusted clients to read pod logs/stats or perform node/pod actions, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_client_ca_file_set

Recommendation

Enforce mutual TLS to the kubelet by providing a trusted clientCAFile.

  • Disable anonymous access
  • Delegate authorization to the API server with least-privilege RBAC
  • Restrict network exposure to the kubelet
  • Rotate certificates and monitor access

Use defense-in-depth across authn and authz.

Remediation

Other

1On each node, open the kubelet config file used by the --config flag (commonly /var/lib/kubelet/config.yaml).
2Add or update this setting to provide a client CA bundle path:
3```yaml
4authentication:
5x509:
6clientCAFile: <path_to_ca_file>
7```
8Save and restart kubelet: `sudo systemctl restart kubelet`

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_client_ca_file_set(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            authentication = cm.kubelet_args.get("authentication")
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if not authentication:
                report.status = "MANUAL"
                report.status_extended = f"Kubelet does not have the argument `readOnlyPort` in config file {cm.name}, verify it in the node's arguments."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Kubelet is missing the client CA file in config file {cm.name}."
                )
                if "clientCAFile" in authentication.get("x509", {}):
                    report.status = "PASS"
                    report.status_extended = f"Kubelet has the client CA file configured appropriately in config file {cm.name}."
            findings.append(report)
        return findings

References