Back to Checks
kubernetes

Kubelet has TLS certificate and private key files configured

kubelet_tls_cert_and_key
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:encryptioncluster-security
Resource Type:ConfigMap

Kubernetes Kubelet configuration includes a TLS serving certificate and private key defined by tlsCertFile and tlsPrivateKeyFile to secure its HTTPS endpoint.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without a verifiable TLS serving cert/key, kubelet traffic may fall back to self-signed or skipped verification, enabling MITM and endpoint spoofing. Attackers could read logs or pod data, run exec/attach, and alter node interactions, compromising confidentiality and integrity, and risking availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_tls_cert_and_key

Recommendation

Provision a CA-signed, node-unique serving certificate and private key for each kubelet and set tlsCertFile and tlsPrivateKeyFile. Prefer automated issuance and rotation. Ensure clients validate the certificate and limit kubelet API exposure with network controls and RBAC, applying least privilege and defense in depth.

Remediation

CLI

kubectl -n kube-system patch configmap <example_resource_name> --type merge -p '{"data":{"kubelet":"tlsCertFile: /var/lib/kubelet/pki/kubelet.crt\ntlsPrivateKeyFile: /var/lib/kubelet/pki/kubelet.key\n"}}'

Terraform

resource "kubernetes_config_map" "<example_resource_name>" {
  metadata {
    name      = "<example_resource_name>"
    namespace = "kube-system"
  }
  data = {
    kubelet = <<-YAML
      tlsCertFile: /var/lib/kubelet/pki/kubelet.crt        # FIX: adds kubelet TLS cert path
      tlsPrivateKeyFile: /var/lib/kubelet/pki/kubelet.key  # FIX: adds kubelet TLS key path
    YAML
  }
}

Other

1In your cluster, open the kubelet config ConfigMap: kubectl -n kube-system edit configmap kubelet-config-<version>
2Under the KubeletConfiguration root, add:
3- tlsCertFile: /var/lib/kubelet/pki/kubelet.crt
4- tlsPrivateKeyFile: /var/lib/kubelet/pki/kubelet.key
5Save and exit.
6On each node, restart kubelet to apply: sudo systemctl restart kubelet
7Verify the ConfigMap now contains both fields and the check passes.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_tls_cert_and_key(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if (
                "tlsCertFile" not in cm.kubelet_args
                or "tlsPrivateKeyFile" not in cm.kubelet_args
            ):
                report.status = "FAIL"
                report.status_extended = f"Kubelet is missing TLS certificate and/or private key configuration in config file {cm.name}."
            else:
                report.status = "PASS"
                report.status_extended = f"Kubelet has appropriate TLS certificate and private key configured in config file {cm.name}."
            findings.append(report)
        return findings

References