Details

Enable certificate based kubelet authentication.

Rationale:

The apiserver, by default, does not authenticate itself to the kubelet’s HTTPS endpoints. The requests from the apiserver are treated anonymously. You should set up certificate-based kubelet authentication to ensure that the apiserver authenticates itself to kubelets when submitting requests.

Impact:

You require TLS to be configured on apiserver as well as kubelets.

Solution

Follow the Kubernetes documentation and set up the TLS connection between the apiserver and kubelets. Then, edit API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the kubelet client certificate and key parameters as below.

–kubelet-client-certificate=–kubelet-client-key=

Default Value:

By default, certificate-based kubelet authentication is not set.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/3371

This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Unix.

References

• 800-53|IA-5(2)
• CSCv6|3.4
• CSCv7|4.5

Source

• Tenable.com/audits