Kubelet client certificate rotation is enabled

​

What this check verifies

Kubernetes Kubelet configuration is inspected for client TLS credential rotation. The finding determines whether rotateCertificates is enabled so kubelets automatically renew the client certificates they use to authenticate to the API server.

​

Risk

Without rotation, kubelet client certs can expire, breaking authentication to the API server and making nodes NotReady, disrupting scheduling and operations (availability). Long-lived certs also widen exposure if keys leak, risking unauthorized access (integrity, confidentiality).

​

Recommendation

Enable kubelet client certificate rotation by setting rotateCertificates: true. Apply controlled CSR approval and monitor certificate health to ensure timely renewals. Prefer short-lived, automatically rotated credentials over static keys, aligning with least privilege and defense in depth. If using an external CA, implement equivalent automated rotation.

​

Remediation

Dashboard steps

1. SSH to each Kubernetes node
2. Open /var/lib/kubelet/config.yaml
3. Add or set the line:
   rotateCertificates: true
   
   If using kubelet flags instead of a config file, remove —rotate-certificates=false (or set —rotate-certificates=true) from the kubelet service options
4. Restart kubelet:
   sudo systemctl restart kubelet
   

​

References

• https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/
• https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_rotate_certificates. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks