1.1.23 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate - kubelet-client-certificate

Information

Enable certificate based kubelet authentication.

Rationale:

The apiserver, by default, does not authenticate itself to the kubelet's HTTPS endpoints. The requests from the apiserver are treated anonymously. You should set up certificate-based kubelet authentication to ensure that the apiserver authenticates itself to kubelets when submitting requests.

Solution

Follow the Kubernetes documentation and set up the TLS connection between the apiserver and kubelets. Then, edit the `/etc/kubernetes/apiserver` file on the master node and set the `KUBE_API_ARGS` parameter to `'--kubelet-client-certificate='` and `'--kubelet-client-key='`: `KUBE_API_ARGS='--kubelet-client-certificate= --kubelet-client-key='`

Based on your system, restart the `kube-apiserver` service. For example: `systemctl restart kube-apiserver.service`

Impact:

You require TLS to be configured on apiserver as well as kubelets.

See Also

https://workbench.cisecurity.org/files/1738

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(2), CSCv6|3.4

Plugin: Unix

Control ID: c275eaef90eff6d465ed81ab4f37fe6582b8c2f437568e3c0cb6d1c886885d8b