API server pod has the --client-ca-file argument set

​

What this check verifies

Kubernetes API server uses a configured client CA (--client-ca-file) to validate x509 client certificates presented for API authentication

​

Risk

Absent a client CA, the API server cannot validate x509 client identities, disabling mutual TLS. This weakens authentication and can enable unauthorized reads or writes to cluster resources, impacting confidentiality and integrity, especially if other methods (e.g., anonymous or weak tokens) are misconfigured.

​

Recommendation

Establish a trusted client CA for the API server and require certificate-based client authentication. Combine with RBAC and least privilege, disable anonymous access, and enforce key rotation and auditing to provide defense in depth.

​

Remediation

Dashboard steps

1. SSH to each control-plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. In the kube-apiserver container command, add this flag (use your CA path if different):
   - --client-ca-file=/etc/kubernetes/pki/ca.crt
   
4. Save the file; the kubelet will restart the API server automatically

​

References

• https://cjyabraham.gitlab.io/docs/reference/command-line-tools-reference/kube-apiserver/
• https://blog.codefarm.me/2019/02/01/access-kubernetes-api-with-client-certificates/
• https://kubernetes.io/docs/setup/best-practices/certificates/#certificate-paths

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_client_ca_file_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks