Check ID: apiserver_kubelet_cert_auth
Provider: Kubernetes
Service: apiserver
Severity: CRITICAL
Categories: cluster-security, encryption
Resource type: Pod

​
What this check verifies

Kubernetes API server is configured with a kubelet certificate authority via --kubelet-certificate-authority so it can validate kubelet serving certificates during APIkubelet TLS connections.

​
Risk

Without a trusted kubelet CA, the API server can’t verify kubelet identities, weakening TLS and enabling man-in-the-middle on control planenode traffic. Attackers could read logs/exec streams (Confidentiality), tamper with responses or commands (Integrity), and disrupt node management (Availability).

​
Recommendation

Enforce mutual TLS for API server-kubelet communication. Provide a trusted CA using --kubelet-certificate-authority, issue certs from controlled PKI, rotate keys, and limit client credentials per least privilege. Prefer private networking and layered controls for defense in depth.

​
Remediation

# kube-apiserver Pod with kubelet CA configured
apiVersion: v1
kind: Pod
metadata:
  name: <example_resource_name>
  namespace: kube-system
spec:
  containers:
  - name: kube-apiserver
    image: registry.k8s.io/kube-apiserver:v1.27.0
    command:
    - kube-apiserver
    - --kubelet-certificate-authority=/etc/kubernetes/pki/ca.crt  # Critical: verifies kubelet certs using this CA to secure apiserver<->kubelet

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_kubelet_cert_auth. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks