Kubelet Rotate Certificates Argument Not Set To False

More Info:

Certificate rotation lets the kubelet automatically renew its client certificate before expiry. Keeping --rotate-certificates enabled avoids outages and long-lived credentials.

Risk Level

High

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, check how kubelet is configured:

   ps -fC kubelet

   • If you see --config=/var/lib/kubelet/config.yaml in the command, use the config file steps (2–3).
   • If you see a --rotate-certificates=false flag on the command line (often via systemd drop-in), use the systemd steps (4–5). You may need both if both are present.

2. On every worker node (config file): back up and edit the kubelet config file:

   sudo cp /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak
   sudo sed -i '/^\s*rotateCertificates\s*:/d' /var/lib/kubelet/config.yaml

   If you prefer it explicitly enabled, instead ensure a line like this exists under the top-level (YAML aligned with other boolean options):

   sudo sed -i '$a rotateCertificates: true' /var/lib/kubelet/config.yaml

3. On every worker node (config file): validate the setting:

   sudo grep -n 'rotateCertificates' /var/lib/kubelet/config.yaml || echo "rotateCertificates unset, default (true) will be used"

4. On every worker node (systemd flags): back up and edit the kubelet systemd drop-in, if present:

   if [ -f /etc/systemd/system/kubelet.service.d/10-kubeadm.conf ]; then
     sudo cp /etc/systemd/system/kubelet.service.d/10-kubeadm.conf /etc/systemd/system/kubelet.service.d/10-kubeadm.conf.bak
     sudo sed -i 's/--rotate-certificates=false//g' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
   fi

5. On every worker node: reload systemd and restart kubelet (this restarts the kubelet process and may briefly affect pod scheduling on that node):

   sudo systemctl daemon-reload
   sudo systemctl restart kubelet.service

6. On every worker node: verify that --rotate-certificates is not set to false:

   ps -fC kubelet | grep kubelet

   Confirm that there is no --rotate-certificates=false in the output.

Using kubectl

kubectl cannot change the kubelet’s --rotate-certificates setting because it is controlled by host-level configuration (/var/lib/kubelet/config.yaml and/or the kubelet systemd unit) on each worker node. Make the change directly on every worker node as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Fix CISKubernetes 4.2.10:
# Ensure the kubelet does not have rotateCertificates=false and that
# rotateCertificates is true (or omitted) in /var/lib/kubelet/config.yaml.
#
# Run on: every worker node (with root privileges).
# Safe to re-run (idempotent).

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubeadm.conf"
BACKUP_SUFFIX="$(date +%Y%m%d%H%M%S)"

echo "==> Ensuring kubelet certificate rotation is not disabled"

# 1) Update kubelet config file (if it exists)
if [ -f "$KUBELET_CONFIG" ]; then
  echo "-> Updating $KUBELET_CONFIG"

  cp -p "$KUBELET_CONFIG" "${KUBELET_CONFIG}.bak.${BACKUP_SUFFIX}"

  # Remove any existing rotateCertificates lines to avoid conflicting values
  sed -i '/^[[:space:]]*rotateCertificates[[:space:]]*:/d' "$KUBELET_CONFIG"

  # Ensure there is a top-level rotateCertificates: true entry
  if ! grep -Eq '^[[:space:]]*rotateCertificates[[:space:]]*:' "$KUBELET_CONFIG"; then
    printf '\nrotateCertificates: true\n' >> "$KUBELET_CONFIG"
  fi
fi

# 2) Clean up kubelet systemd drop-in, removing any --rotate-certificates=false
if [ -f "$SYSTEMD_DROPIN" ]; then
  echo "-> Updating $SYSTEMD_DROPIN"

  cp -p "$SYSTEMD_DROPIN" "${SYSTEMD_DROPIN}.bak.${BACKUP_SUFFIX}"

  # Remove explicit disabling flag from any argument line
  sed -i 's/--rotate-certificates=false//g' "$SYSTEMD_DROPIN"

  # Also clean up any duplicated spaces left behind
  sed -i 's/  \+/ /g' "$SYSTEMD_DROPIN"
fi

# 3) Reload systemd and restart kubelet (this will restart kubelet on this node)
echo "-> Reloading systemd and restarting kubelet (this will temporarily restart kubelet)"
systemctl daemon-reload
systemctl restart kubelet.service

# 4) Verification: ensure kubelet process is not started with --rotate-certificates=false
echo "-> Verifying kubelet process flags"
if /bin/ps -fC kubelet | grep -q -- '--rotate-certificates=false'; then
  echo "ERROR: kubelet is still running with --rotate-certificates=false"
  /bin/ps -fC kubelet
  exit 1
fi

# 5) Additional verification: confirm rotateCertificates is not set to false in config file
if [ -f "$KUBELET_CONFIG" ]; then
  if grep -Eq '^[[:space:]]*rotateCertificates[[:space:]]*:[[:space:]]*false[[:space:]]*$' "$KUBELET_CONFIG"; then
    echo "ERROR: rotateCertificates:false still present in $KUBELET_CONFIG"
    exit 1
  fi
fi

echo "==> Success: kubelet certificate rotation is not disabled on this node."
echo "Current kubelet process:"
/bin/ps -fC kubelet || true