Description

The kubelet reads various parameters, including security settings, from a config file. RotateKubeletServerCertificate causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad. Orca has detected that the RotateKubeletServerCertificate flag is set to false on {K8sNode.Vm}.

• 

  Recommended Mitigation

  Consider setting {K8sNode}'s Kubelet's RotateKubeletServerCertificate to true. This recommendation only applies if you let kubelets get their certificates from the API server.