API server sets --tls-cert-file and --tls-private-key-file

​

What this check verifies

Kubernetes API server configuration is checked for explicit TLS settings via --tls-cert-file and --tls-private-key-file. The presence of both flags indicates HTTPS is configured with a specified certificate and private key for client connections.

​

Risk

Improper or unmanaged TLS on the API endpoint can cause untrusted certs and verification bypass, enabling MITM to capture admin credentials or tokens and modify requests. This compromises confidentiality and integrity, and unexpected certificate expiry can affect availability.

​

Recommendation

Configure the API server to use TLS with a valid certificate and key via --tls-cert-file and --tls-private-key-file. Use a trusted CA with correct SANs, restrict network access to the endpoint, and automate certificate rotation and expiry monitoring to uphold defense in depth and least privilege.

​

Remediation

Dashboard steps

1. SSH to each control-plane node
2. Edit the API server static pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3. In spec.containers[0].command, add both flags:
   - --tls-cert-file=/etc/kubernetes/pki/apiserver.crt
   - --tls-private-key-file=/etc/kubernetes/pki/apiserver.key
   
4. Save the file; the kubelet will automatically restart the API server

​

References

• https://kubernetes.io/docs/setup/best-practices/certificates/#certificate-paths

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_tls_config. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks