Skip to main content

Ensure Rotate Certificates Argument Is Not Set False

More Info:​

Enable kubelet client certificate rotation.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS GKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, back up the kubelet config before editing:

    sudo cp -a /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak.$(date +%F-%H%M%S)

  2. On every worker node, edit the kubelet config file and ensure rotateCertificates is not set to false (either set it to true or remove the line completely). For example, to force it to true:

    sudo sed -i 's/^[[:space:]]*rotateCertificates:[[:space:]]*false/rotateCertificates: true/' /var/lib/kubelet/config.yaml

    Then open the file to confirm:

    sudo vi /var/lib/kubelet/config.yaml

    and, if needed, manually add:

    rotateCertificates: true

    under the appropriate kubelet config section.

  3. If the kubelet is also configured via systemd flags, on every worker node check for an explicit --rotate-certificates=false argument:

    sudo grep -R --color -n 'rotate-certificates' /etc/systemd/system/kubelet.service.d /etc/systemd/system/kubelet.service 2>/dev/null

    If found (commonly in /etc/systemd/system/kubelet.service.d/10-kubeadm.conf), edit the file and remove the --rotate-certificates=false flag from the KUBELET_CERTIFICATE_ARGS (or similar) line:

    sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

    Save the file after removing just that flag.

  4. On every worker node, reload systemd configuration and restart kubelet:

    sudo systemctl daemon-reload
    sudo systemctl restart kubelet.service

  5. On every worker node, verify via the process list that kubelet is not running with --rotate-certificates=false:

    /bin/ps -fC kubelet

    Inspect the output and confirm that:

    • there is no --rotate-certificates=false argument present, and
    • if a --rotate-certificates flag is present, it is not set to false.
Using kubectl

kubectl cannot modify kubelet host-level configuration such as /var/lib/kubelet/config.yaml or systemd units on worker nodes. To remediate this finding, make the changes directly on each worker node as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Purpose: Ensure kubelet client certificate rotation is enabled (rotateCertificates != false)
# Scope:   Run on EVERY WORKER NODE (as root). Safe to re-run.

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
NEED_RESTART=0

echo "[*] Ensuring kubelet rotateCertificates is enabled on this node..."

# 1. Fix kubelet config file, if present
if [ -f "$CONFIG_FILE" ]; then
  echo "[-] Found kubelet config file at $CONFIG_FILE"

  # Backup once per day
  BACKUP="${CONFIG_FILE}.$(date +%F-%H%M%S).bak"
  cp -p "$CONFIG_FILE" "$BACKUP"
  echo "    Backup created at $BACKUP"

  # If rotateCertificates is explicitly set to false, change to true
  if grep -qE '^[[:space:]]*rotateCertificates:[[:space:]]*false[[:space:]]*$' "$CONFIG_FILE"; then
    echo "    rotateCertificates: false found, changing to true"
    sed -i -E 's/^([[:space:]]*rotateCertificates:)[[:space:]]*false[[:space:]]*$/\1 true/' "$CONFIG_FILE"
    NEED_RESTART=1
  else
    # Ensure rotateCertificates: true is present if not set at all
    if ! grep -qE '^[[:space:]]*rotateCertificates:[[:space:]]*(true|false)[[:space:]]*$' "$CONFIG_FILE"; then
      echo "    rotateCertificates not set; adding rotateCertificates: true"
      # Append at end; kubelet config file is YAML, this adds a top-level key
      printf "\nrotateCertificates: true\n" >> "$CONFIG_FILE"
      NEED_RESTART=1
    else
      echo "    rotateCertificates is already not false; no change needed in config file"
    fi
  fi
else
  echo "[-] No kubelet config file at $CONFIG_FILE; skipping config.yaml changes"
fi

# 2. Fix systemd kubelet arguments if present
if [ -f "$SYSTEMD_DROPIN" ]; then
  echo "[-] Checking systemd drop-in at $SYSTEMD_DROPIN for --rotate-certificates=false"

  if grep -q -- '--rotate-certificates=false' "$SYSTEMD_DROPIN"; then
    BACKUP="${SYSTEMD_DROPIN}.$(date +%F-%H%M%S).bak"
    cp -p "$SYSTEMD_DROPIN" "$BACKUP"
    echo "    Backup created at $BACKUP"

    # Remove ONLY the --rotate-certificates=false argument (handles lists/whitespace)
    sed -i 's/--rotate-certificates=false//g' "$SYSTEMD_DROPIN"
    # Normalize multiple spaces left behind
    sed -i 's/[[:space:]]\+/ /g' "$SYSTEMD_DROPIN"
    NEED_RESTART=1
    echo "    Removed --rotate-certificates=false from kubelet systemd configuration"
  else
    echo "    No --rotate-certificates=false found in $SYSTEMD_DROPIN"
  fi
else
  echo "[-] No systemd drop-in at $SYSTEMD_DROPIN; skipping systemd arg changes"
fi

# 3. Restart kubelet if needed
if [ "$NEED_RESTART" -eq 1 ]; then
  echo "[-] Applying changes by restarting kubelet (this will restart the kubelet and may briefly affect pod scheduling on this node)..."
  systemctl daemon-reload
  systemctl restart kubelet.service
else
  echo "[-] No changes made; kubelet restart not required"
fi

# 4. Verification (as per audit command)
/bin/ps -fC kubelet || {
  echo "[!] kubelet process not found after changes" >&2
  exit 1
}

echo
echo "[*] Verification: kubelet process command line (ensure --rotate-certificates=false is absent):"
/bin/ps -fC kubelet

if [ -f "$CONFIG_FILE" ]; then
  echo
  echo "[*] Verification: rotateCertificates setting in $CONFIG_FILE:"
  grep -nE 'rotateCertificates' "$CONFIG_FILE" || echo "    (rotateCertificates not explicitly set; default applies)"
fi

echo
echo "[*] Completed. Run this script on every worker node."

Additional Reading:​