Tls Cert File And Tls Private Key File Arguments Are Set

More Info:

Setup TLS connection on the Kubelets.

Risk Level

Low

Address

Security

Compliance Standards

CIS GKE

Triage and Remediation

Remediation

Remediation

Manual Steps

On every worker node, confirm the kubelet is using a config file and locate it:
```
ps -fC kubelet
# Look for a flag like: --config=/var/lib/kubelet/config.yaml
```
If the kubelet does not use --config, skip to step 3 (CLI-flag configuration).
Edit the kubelet config file on that worker node to set TLS certificate and key paths (adjust paths to your actual cert and key locations):
```
sudo vi /var/lib/kubelet/config.yaml
```
Ensure these fields exist under the top-level config (add or update as needed):
```
tlsCertFile: "/var/lib/kubelet/pki/kubelet.crt"
tlsPrivateKeyFile: "/var/lib/kubelet/pki/kubelet.key"
```
Save and exit.
If instead the kubelet is configured via CLI flags, edit the systemd drop-in on that worker node:
```
sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
```
Add or update a line like the following in the KUBELET_CERTIFICATE_ARGS environment or equivalent, pointing to the correct cert/key:
```
Environment="KUBELET_CERTIFICATE_ARGS=--tls-cert-file=/var/lib/kubelet/pki/kubelet.crt --tls-private-key-file=/var/lib/kubelet/pki/kubelet.key"
```
Ensure this variable is referenced in the kubelet ExecStart (commonly via $KUBELET_CERTIFICATE_ARGS).
Reload systemd and restart the kubelet on that worker node (this will restart the kubelet and may briefly impact node status/workload scheduling):
```
sudo systemctl daemon-reload
sudo systemctl restart kubelet.service
```
Repeat steps 1–4 on every worker node, using the correct certificate/key paths for each node as appropriate.
Verify on each worker node that kubelet is running with the expected TLS configuration:
```
ps -fC kubelet
```
- If using config file, ensure the process has --config=/var/lib/kubelet/config.yaml and that file contains the tlsCertFile and tlsPrivateKeyFile entries you set.
- If using CLI flags, ensure the kubelet command line now includes --tls-cert-file= and --tls-private-key-file= with the correct paths.

Using kubectl

kubectl cannot configure kubelet TLS options or edit /var/lib/kubelet/config.yaml or systemd units on worker nodes. Make the required changes directly on each worker node’s host configuration as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Purpose: Ensure kubelet TLS certificate and key are configured via config.yaml
# Scope:   Run on every worker node (as root)
# Idempotent: Yes (safe to re-run)
#
# Requirements:
#   - Kubelet config at /var/lib/kubelet/config.yaml
#   - TLS cert/key already present on the node
#

set -euo pipefail

# ---------------------------
# CONFIGURE THESE PER CLUSTER
# ---------------------------
TLS_CERT_FILE="/var/lib/kubelet/pki/kubelet.crt"
TLS_KEY_FILE="/var/lib/kubelet/pki/kubelet.key"
KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"

backup_file() {
  local f="$1"
  if [[ -f "$f" && ! -f "${f}.pre-tls-backup" ]]; then
    cp -p "$f" "${f}.pre-tls-backup"
  fi
}

echo "[*] Ensuring kubelet TLS configuration on worker node: $(hostname)"

# 1. Validate inputs
if [[ ! -f "$TLS_CERT_FILE" ]]; then
  echo "ERROR: TLS certificate file not found: $TLS_CERT_FILE" >&2
  exit 1
fi
if [[ ! -f "$TLS_KEY_FILE" ]]; then
  echo "ERROR: TLS private key file not found: $TLS_KEY_FILE" >&2
  exit 1
fi
if [[ ! -f "$KUBELET_CONFIG" ]]; then
  echo "ERROR: kubelet config not found at $KUBELET_CONFIG" >&2
  echo "This script assumes kubelet is configured via config.yaml." >&2
  exit 1
fi

# 2. Configure kubelet config.yaml (preferred per remediation)
echo "[*] Updating $KUBELET_CONFIG with tlsCertFile and tlsPrivateKeyFile"
backup_file "$KUBELET_CONFIG"

# Ensure top-level keys exist and set values (simple, idempotent YAML edits)
# If keys exist, replace their values; if not, append them.
if grep -qE '^\s*tlsCertFile:' "$KUBELET_CONFIG"; then
  sed -i "s|^\(\s*tlsCertFile:\).*|\1 \"$TLS_CERT_FILE\"|" "$KUBELET_CONFIG"
else
  printf "\n# Added by kubelet TLS hardening script\n" >> "$KUBELET_CONFIG"
  printf "tlsCertFile: \"%s\"\n" "$TLS_CERT_FILE" >> "$KUBELET_CONFIG"
fi

if grep -qE '^\s*tlsPrivateKeyFile:' "$KUBELET_CONFIG"; then
  sed -i "s|^\(\s*tlsPrivateKeyFile:\).*|\1 \"$TLS_KEY_FILE\"|" "$KUBELET_CONFIG"
else
  printf "tlsPrivateKeyFile: \"%s\"\n" "$TLS_KEY_FILE" >> "$KUBELET_CONFIG"
fi

# 3. (Optional but safe) ensure systemd drop-in does not conflict
if [[ -f "$SYSTEMD_DROPIN" ]]; then
  echo "[*] Checking for conflicting --tls-* flags in $SYSTEMD_DROPIN"
  backup_file "$SYSTEMD_DROPIN"
  # Remove explicit --tls-cert-file/--tls-private-key-file from KUBELET_CERTIFICATE_ARGS if present
  sed -i 's/--tls-cert-file=[^ ]*//g' "$SYSTEMD_DROPIN"
  sed -i 's/--tls-private-key-file=[^ ]*//g' "$SYSTEMD_DROPIN"
  # Clean up any duplicated spaces
  sed -i 's/  \+/ /g' "$SYSTEMD_DROPIN"
fi

# 4. Reload and restart kubelet (operational impact: kubelet briefly restarts)
echo "[*] Reloading systemd and restarting kubelet"
systemctl daemon-reload
systemctl restart kubelet.service

# 5. Verification (adapted from audit)
echo "[*] Verifying kubelet process arguments and config"

echo "---- kubelet process ----"
/bin/ps -fC kubelet || {
  echo "ERROR: kubelet process not found after restart" >&2
  exit 1
}

echo
echo "---- effective TLS settings from $KUBELET_CONFIG ----"
grep -E '^\s*tls(CertFile|PrivateKeyFile):' "$KUBELET_CONFIG" || {
  echo "ERROR: tlsCertFile/tlsPrivateKeyFile not found in $KUBELET_CONFIG" >&2
  exit 1
}

echo
echo "[OK] kubelet TLS certificate and key configured on $(hostname)"

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​