Back to Checks
kubernetes

Kubelet client certificate rotation is enabled

kubelet_rotate_certificates
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:encryptionnode-security
Resource Type:ConfigMap

Kubernetes Kubelet configuration is inspected for client TLS credential rotation. The finding determines whether rotateCertificates is enabled so kubelets automatically renew the client certificates they use to authenticate to the API server.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without rotation, kubelet client certs can expire, breaking authentication to the API server and making nodes NotReady, disrupting scheduling and operations (availability). Long-lived certs also widen exposure if keys leak, risking unauthorized access (integrity, confidentiality).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_rotate_certificates

Recommendation

Enable kubelet client certificate rotation by setting rotateCertificates: true. Apply controlled CSR approval and monitor certificate health to ensure timely renewals. Prefer short-lived, automatically rotated credentials over static keys, aligning with least privilege and defense in depth. If using an external CA, implement equivalent automated rotation.

Remediation

Other

1SSH to each Kubernetes node
2Open /var/lib/kubelet/config.yaml
3Add or set the line:
4```yaml
5rotateCertificates: true
6```
7If using kubelet flags instead of a config file, remove --rotate-certificates=false (or set --rotate-certificates=true) from the kubelet service options
8Restart kubelet:
9```
10sudo systemctl restart kubelet
11```

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_rotate_certificates(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if "rotateCertificates" not in cm.kubelet_args:
                report.status = "MANUAL"
                report.status_extended = f"Kubelet does not have the argument `streamingConnectionIdleTimeout` in config file {cm.name}, verify it in the node's arguments."
            else:
                if cm.kubelet_args["rotateCertificates"]:
                    report.status = "PASS"
                    report.status_extended = f"Kubelet has certificate rotation enabled in config file {cm.name}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Kubelet has client certificate rotation disabled in config file {cm.name}."
            findings.append(report)
        return findings

References