Workload misconfigurations

Kubernetes node’s kubelet’s RotateKubeletServerCertificate is set to false

Risk Level

Informational (4)

  • N/A


The kubelet reads various parameters, including security settings, from a config file. RotateKubeletServerCertificate causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad. Orca has detected that the RotateKubeletServerCertificate flag is set to false on {K8sNode.Vm}.
  • Recommended Mitigation

    Consider setting {K8sNode}'s Kubelet's RotateKubeletServerCertificate to true. This recommendation only applies if you let kubelets get their certificates from the API server.