Check ID: kubelet_client_ca_file_set
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: cluster-security, identity-access
Resource type: ConfigMap

​
What this check verifies

Kubernetes Kubelet is evaluated for X.509 client certificate authentication by checking if its config sets authentication.x509.clientCAFile to validate clients on the HTTPS endpoint.

​
Risk

Without a client CA, the kubelet cannot verify client certificates, weakening authentication. With network access, attackers could impersonate trusted clients to read pod logs/stats or perform node/pod actions, impacting confidentiality, integrity, and availability.

​
Recommendation

Enforce mutual TLS to the kubelet by providing a trusted clientCAFile.
  • Disable anonymous access
  • Delegate authorization to the API server with least-privilege RBAC
  • Restrict network exposure to the kubelet
  • Rotate certificates and monitor access
Use defense-in-depth across authn and authz.

​
Remediation

Dashboard steps
  1. On each node, open the kubelet config file used by the —config flag (commonly /var/lib/kubelet/config.yaml).
  2. Add or update this setting to provide a client CA bundle path: 
    authentication:
  x509:
    clientCAFile: <path_to_ca_file>
  3. Save and restart kubelet: sudo systemctl restart kubelet

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_client_ca_file_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks