Check ID: apiserver_kubelet_tls_auth
Provider: Kubernetes
Service: apiserver
Severity: CRITICAL
Categories: cluster-security, encryption
Resource type: Pod

​
What this check verifies

Kubernetes API server is configured to use TLS client certificates when communicating with kubelets via --kubelet-client-certificate and --kubelet-client-key.

​
Risk

Without mTLS to kubelets, apiserver requests may be anonymous or weakly authenticated. Adversaries can abuse kubelet endpoints to:
  • Read logs and files (C)
  • Exec into pods (I)
  • Evict or disrupt pods (A) Enables lateral movement and workload tampering.

​
Recommendation

Enforce mutual TLS between apiserver and kubelets using a dedicated client certificate/key (--kubelet-client-certificate, --kubelet-client-key) signed by a trusted CA. Apply least privilege to kubelet authorization and disable anonymous access to strengthen defense-in-depth.

​
Remediation

Dashboard steps
  1. SSH to the control plane node.
  2. Edit the API server static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
  3. Under spec.containers[0].command add both flags (use existing certs in /etc/kubernetes/pki): —kubelet-client-certificate=/etc/kubernetes/pki/apiserver-kubelet-client.crt —kubelet-client-key=/etc/kubernetes/pki/apiserver-kubelet-client.key
  4. Save the file; the kubelet will automatically restart the API server with the new flags.

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_kubelet_tls_auth. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks