Kubelet has TLS certificate and private key files configured

Check ID: kubelet_tls_cert_and_key
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: encryption, cluster-security
Resource type: ConfigMap

What this check verifies

Kubernetes Kubelet configuration includes a TLS serving certificate and private key defined by tlsCertFile and tlsPrivateKeyFile to secure its HTTPS endpoint.

Risk

Without a verifiable TLS serving cert/key, kubelet traffic may fall back to self-signed or skipped verification, enabling MITM and endpoint spoofing. Attackers could read logs or pod data, run exec/attach, and alter node interactions, compromising confidentiality and integrity, and risking availability.

Recommendation

Provision a CA-signed, node-unique serving certificate and private key for each kubelet and set tlsCertFile and tlsPrivateKeyFile. Prefer automated issuance and rotation. Ensure clients validate the certificate and limit kubelet API exposure with network controls and RBAC, applying least privilege and defense in depth.

Remediation

CLI
Terraform
Dashboard steps

kubectl -n kube-system patch configmap <example_resource_name> --type merge -p '{"data":{"kubelet":"tlsCertFile: /var/lib/kubelet/pki/kubelet.crt\ntlsPrivateKeyFile: /var/lib/kubelet/pki/kubelet.key\n"}}'

resource "kubernetes_config_map" "<example_resource_name>" {
  metadata {
    name      = "<example_resource_name>"
    namespace = "kube-system"
  }
  data = {
    kubelet = <<-YAML
      tlsCertFile: /var/lib/kubelet/pki/kubelet.crt        # FIX: adds kubelet TLS cert path
      tlsPrivateKeyFile: /var/lib/kubelet/pki/kubelet.key  # FIX: adds kubelet TLS key path
    YAML
  }
}

References

https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_tls_cert_and_key. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to Kubernetes checks

Kubelet uses only strong TLS cipher suites Cluster role binding does not grant the cluster-admin role

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires