> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Rotate Certificates Argument Not Set To False

### More Info:

Certificate rotation lets the kubelet automatically renew its client certificate before expiry. Keeping --rotate-certificates enabled avoids outages and long-lived credentials.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check how kubelet is configured:
           ```bash theme={null}
           ps -fC kubelet
           ```
           * If you see `--config=/var/lib/kubelet/config.yaml` in the command, use the config file steps (2–3).
           * If you see a `--rotate-certificates=false` flag on the command line (often via systemd drop-in), use the systemd steps (4–5). You may need both if both are present.

        2. On every worker node (config file): back up and edit the kubelet config file:
           ```bash theme={null}
           sudo cp /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak
           sudo sed -i '/^\s*rotateCertificates\s*:/d' /var/lib/kubelet/config.yaml
           ```
           If you prefer it explicitly enabled, instead ensure a line like this exists under the top-level (YAML aligned with other boolean options):
           ```bash theme={null}
           sudo sed -i '$a rotateCertificates: true' /var/lib/kubelet/config.yaml
           ```

        3. On every worker node (config file): validate the setting:
           ```bash theme={null}
           sudo grep -n 'rotateCertificates' /var/lib/kubelet/config.yaml || echo "rotateCertificates unset, default (true) will be used"
           ```

        4. On every worker node (systemd flags): back up and edit the kubelet systemd drop-in, if present:
           ```bash theme={null}
           if [ -f /etc/systemd/system/kubelet.service.d/10-kubeadm.conf ]; then
             sudo cp /etc/systemd/system/kubelet.service.d/10-kubeadm.conf /etc/systemd/system/kubelet.service.d/10-kubeadm.conf.bak
             sudo sed -i 's/--rotate-certificates=false//g' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
           fi
           ```

        5. On every worker node: reload systemd and restart kubelet (this restarts the kubelet process and may briefly affect pod scheduling on that node):
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        6. On every worker node: verify that `--rotate-certificates` is not set to `false`:
           ```bash theme={null}
           ps -fC kubelet | grep kubelet
           ```
           Confirm that there is no `--rotate-certificates=false` in the output.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change the kubelet’s `--rotate-certificates` setting because it is controlled by host-level configuration (`/var/lib/kubelet/config.yaml` and/or the kubelet systemd unit) on each worker node. Make the change directly on every worker node as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CISKubernetes 4.2.10:
        # Ensure the kubelet does not have rotateCertificates=false and that
        # rotateCertificates is true (or omitted) in /var/lib/kubelet/config.yaml.
        #
        # Run on: every worker node (with root privileges).
        # Safe to re-run (idempotent).

        set -euo pipefail

        KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
        SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
        BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

        echo "==> Ensuring kubelet certificate rotation is not disabled"

        # 1) Update kubelet config file (if it exists)
        if [ -f "$KUBELET_CONFIG" ]; then
          echo "-> Updating $KUBELET_CONFIG"

          cp -p "$KUBELET_CONFIG" "${KUBELET_CONFIG}.bak.${BACKUP_SUFFIX}"

          # Remove any existing rotateCertificates lines to avoid conflicting values
          sed -i '/^[[:space:]]*rotateCertificates[[:space:]]*:/d' "$KUBELET_CONFIG"

          # Ensure there is a top-level rotateCertificates: true entry
          if ! grep -Eq '^[[:space:]]*rotateCertificates[[:space:]]*:' "$KUBELET_CONFIG"; then
            printf '\nrotateCertificates: true\n' >> "$KUBELET_CONFIG"
          fi
        fi

        # 2) Clean up kubelet systemd drop-in, removing any --rotate-certificates=false
        if [ -f "$SYSTEMD_DROPIN" ]; then
          echo "-> Updating $SYSTEMD_DROPIN"

          cp -p "$SYSTEMD_DROPIN" "${SYSTEMD_DROPIN}.bak.${BACKUP_SUFFIX}"

          # Remove explicit disabling flag from any argument line
          sed -i 's/--rotate-certificates=false//g' "$SYSTEMD_DROPIN"

          # Also clean up any duplicated spaces left behind
          sed -i 's/  \+/ /g' "$SYSTEMD_DROPIN"
        fi

        # 3) Reload systemd and restart kubelet (this will restart kubelet on this node)
        echo "-> Reloading systemd and restarting kubelet (this will temporarily restart kubelet)"
        systemctl daemon-reload
        systemctl restart kubelet.service

        # 4) Verification: ensure kubelet process is not started with --rotate-certificates=false
        echo "-> Verifying kubelet process flags"
        if /bin/ps -fC kubelet | grep -q -- '--rotate-certificates=false'; then
          echo "ERROR: kubelet is still running with --rotate-certificates=false"
          /bin/ps -fC kubelet
          exit 1
        fi

        # 5) Additional verification: confirm rotateCertificates is not set to false in config file
        if [ -f "$KUBELET_CONFIG" ]; then
          if grep -Eq '^[[:space:]]*rotateCertificates[[:space:]]*:[[:space:]]*false[[:space:]]*$' "$KUBELET_CONFIG"; then
            echo "ERROR: rotateCertificates:false still present in $KUBELET_CONFIG"
            exit 1
          fi
        fi

        echo "==> Success: kubelet certificate rotation is not disabled on this node."
        echo "Current kubelet process:"
        /bin/ps -fC kubelet || true
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>