Check ID: controllermanager_rotate_kubelet_server_cert
Provider: Kubernetes
Service: controllermanager
Severity: MEDIUM
Categories: encryption, cluster-security
Resource type: Pod

​
What this check verifies

Kubernetes controller manager configuration includes the RotateKubeletServerCertificate=true feature gate for automatic rotation of kubelet server certificates

​
Risk

Without certificate rotation, kubelet HTTPS endpoints can use expired or long-lived certs, triggering TLS failures and operational gaps. Teams may bypass verification, enabling MitM and tampering. This harms availability and integrity, and extends exposure if a private key is compromised.

​
Recommendation

Enable RotateKubeletServerCertificate=true on the controller manager and ensure kubelets participate in rotation. Use short-lived certs, automated renewal, and strict TLS validation to maintain availability, protect integrity, and uphold cryptographic hygiene. Avoid insecure fallbacks.

​
Remediation

Dashboard steps
  1. SSH to a control-plane node and open the controller manager static pod manifest:
    • /etc/kubernetes/manifests/kube-controller-manager.yaml
  2. In spec.containers[0].command, add or update this flag: 
    --feature-gates=RotateKubeletServerCertificate=true
  3. Save the file; the kubelet will automatically restart the pod with the updated setting.

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = controllermanager_rotate_kubelet_server_cert. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks