Workload misconfigurations

Kubernetes node’s kubelet’s RotateKubeletServerCertificate is set to false

Risk Level

Informational (4)

Platform(s)

  • N/A

Description

The kubelet reads various parameters, including security settings, from a config file. RotateKubeletServerCertificate causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad. Orca has detected that the RotateKubeletServerCertificate flag is set to false on {K8sNode.Vm}.

  • Recommended Mitigation

    Set {K8sNode}'s Kubelet's RotateKubeletServerCertificate to true. This recommendation only applies if you let kubelets get their certificates from the API server.

Need help?

Get a free Security Risk Assessment. Start today

See Orca in action See Orca in action-> View a 10 minute recorded demo or sign up for a personalized one-on-one walk-through.