Check ID: controllermanager_root_ca_file_set
Provider: Kubernetes
Service: controllermanager
Severity: CRITICAL
Categories: encryption, cluster-security
Resource type: Pod

​
What this check verifies

Kubernetes Controller Manager uses --root-ca-file to reference a certificate bundle so pods get a ca.crt for validating the API server’s TLS certificate.

​
Risk

Without a configured root CA, pods cannot reliably verify the API server, enabling on-path spoofing. This exposes API traffic and service account tokens, allowing session hijack, data exfiltration, and malicious config changes-compromising confidentiality and integrity, and potentially disrupting availability.

​
Recommendation

Set a trusted CA bundle via --root-ca-file on the controller manager to ensure verified TLS for in-cluster API calls. Use a cluster-controlled CA, rotate and monitor certificates, and keep the bundle aligned with the API server chain. Apply defense in depth and least privilege for service accounts.

​
Remediation

Dashboard steps
  1. SSH to a control-plane node with sudo privileges
  2. Edit the static Pod manifest: /etc/kubernetes/manifests/kube-controller-manager.yaml
  3. In the kube-controller-manager container command list, add this flag:
    • —root-ca-file=/etc/kubernetes/pki/ca.crt
  4. Save the file; kubelet will automatically restart the Pod

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = controllermanager_root_ca_file_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks