Skip to main content

Ensure Rotate Certificates Argument Is Not Set Disabled

More Info:​

Enable kubelet client certificate rotation.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS Critical Security Controls v8
  • CIS OKE
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, open the kubelet systemd drop-in config for editing:

    sudo vi /etc/systemd/system/kubelet.service.d/00-default.conf

  2. In the ExecStart= line for kubelet, ensure the --rotate-certificates flag is present and not set to false. For example, include it like this (add to existing flags if needed):

    ExecStart=...kubelet ... --rotate-certificates=true

    Save and exit the file.

  3. If your kubelet is configured via /var/lib/kubelet/config.yaml, ensure nothing in that file disables rotation (there is no standard boolean to set to false, but check for and remove any deprecated or custom options that might override the flag):

    sudo vi /var/lib/kubelet/config.yaml

    Save without adding any setting that disables certificate rotation.

  4. Reload systemd configuration and restart kubelet on the same worker node:

    sudo systemctl daemon-reload
    sudo systemctl restart kubelet.service

  5. Confirm kubelet is running correctly:

    sudo systemctl status kubelet -l

  6. Verify the fix on the same worker node by confirming the kubelet process includes --rotate-certificates and not --rotate-certificates=false:

    /bin/ps -fC kubelet

    Inspect the output and ensure the kubelet command line contains --rotate-certificates with no =false.

Using kubectl

kubectl cannot modify kubelet process flags or its config file on worker nodes, so this finding cannot be fixed via the Kubernetes API. The required change must be made on each worker node’s host configuration (for example in /etc/systemd/system/kubelet.service.d/00-default.conf and /var/lib/kubelet/config.yaml); see the Manual Steps section for how to do this.

Automation
#!/usr/bin/env bash
#
# Enable kubelet client certificate rotation on all worker nodes.
# Run this on each worker node as root.
#
# Idempotent: safe to re-run; only ensures rotateCertificates: true
# in /var/lib/kubelet/config.yaml and makes sure kubelet sees it.

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
SYSTEMD_DROPIN="${SYSTEMD_DROPIN_DIR}/00-default.conf"

echo "[INFO] Starting kubelet certificate rotation remediation"

if [[ ! -f "${KUBELET_CONFIG}" ]]; then
  echo "[ERROR] ${KUBELET_CONFIG} not found. This script expects kubelet to be using a config file at this path."
  exit 1
fi

# Ensure the systemd drop-in directory exists (needed per remediation text)
if [[ ! -d "${SYSTEMD_DROPIN_DIR}" ]]; then
  echo "[INFO] Creating systemd drop-in directory: ${SYSTEMD_DROPIN_DIR}"
  mkdir -p "${SYSTEMD_DROPIN_DIR}"
fi

# Ensure a kubelet systemd drop-in file exists; if it doesn't, create a minimal one.
if [[ ! -f "${SYSTEMD_DROPIN}" ]]; then
  echo "[INFO] Creating minimal kubelet systemd drop-in: ${SYSTEMD_DROPIN}"
  cat > "${SYSTEMD_DROPIN}" <<'EOF'
[Service]
Environment="KUBELET_EXTRA_ARGS="
EOF
  systemctl daemon-reload
fi

# Ensure rotateCertificates: true is set in the kubelet config file
echo "[INFO] Ensuring rotateCertificates: true in ${KUBELET_CONFIG}"

if grep -qE '^\s*rotateCertificates:' "${KUBELET_CONFIG}"; then
  # Key exists; ensure it's set to true
  sed -i -E 's/^\s*rotateCertificates:\s*(true|false)\s*$/rotateCertificates: true/' "${KUBELET_CONFIG}"
else
  # Key does not exist; append it in a commented section
  {
    echo ""
    echo "# Ensured by CIS OKE 3.2.9 remediation"
    echo "rotateCertificates: true"
  } >> "${KUBELET_CONFIG}"
fi

# Reload and restart kubelet so it picks up the change
echo "[INFO] Restarting kubelet to apply configuration"
systemctl daemon-reload
systemctl restart kubelet.service

sleep 5

echo "[INFO] Kubelet status:"
systemctl status kubelet -l --no-pager || true

# Verification 1: process arguments do NOT explicitly disable rotation
echo "[INFO] Verifying kubelet process does not set --rotate-certificates=false"
if /bin/ps -fC kubelet | grep -q -- '--rotate-certificates=false'; then
  echo "[FAIL] kubelet is still running with --rotate-certificates=false"
  /bin/ps -fC kubelet
  exit 1
fi

# Verification 2: kubelet config file has rotateCertificates: true
echo "[INFO] Verifying ${KUBELET_CONFIG} contains rotateCertificates: true"
if ! grep -qE '^\s*rotateCertificates:\s*true\s*$' "${KUBELET_CONFIG}"; then
  echo "[FAIL] rotateCertificates: true not found in ${KUBELET_CONFIG}"
  grep -n 'rotateCertificates' "${KUBELET_CONFIG}" || true
  exit 1
fi

echo "[INFO] Remediation complete and verified on this node."

Additional Reading:​