2.1.12 Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate - tls-private-key-file

Information

Setup TLS connection on the Kubelets.

Rationale:

Kubelet communication contains sensitive parameters that should remain encrypted in transit. Configure the Kubelets to serve only HTTPS traffic.

Solution

Follow the Kubernetes documentation and set up the TLS connection on the Kubelet.

Then edit the kubelet service file '/etc/systemd/system/kubelet.service.d/10-kubeadm.conf' on each worker node and set the below parameters in 'KUBELET_CERTIFICATE_ARGS' variable.

--tls-cert-file=
--tls-private-key-file=

Based on your system, restart the 'kubelet' service. For example:

systemctl daemon-reload
systemctl restart kubelet.service

Impact:

TLS and client certificate authentication must be configured for your Kubernetes cluster deployment.

See Also

https://workbench.cisecurity.org/files/1788

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(2), CSCv6|14.2

Plugin: Unix

Control ID: 9828dee40c6b3c63f79848e71fd0af0b8bff0d80cc6cb65fb3f633c95a883f7b