Project: KICS (Provisioning / Security & Compliance)
File: 1c621b8e-2c6a-44f5-bd6a-fb0fb7ba33e2.md

title: Rotate Kubelet Server Certificate Not Active hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1c621b8e-2c6a-44f5-bd6a-fb0fb7ba33e2 Query name: Rotate Kubelet Server Certificate Not Active Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Secret Management URL: The RotateKubeletServerCertificate argument should be true<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="8" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false evictionHard: memory.available: "200Mi" featureGates: RotateKubeletServerCertificate: false ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--feature-gates=RotateKubeletServerCertificate=false"] restartPolicy: OnFailure ``` ```json title="Positive test num. 3 - json file" hl_lines="8" { "kind": "KubeletConfiguration", "address": "192.168.0.8", "apiVersion": "kubelet.config.k8s.io/v1beta1", "evictionHard": { "memory.available": "200Mi" }, "featureGates": { "RotateKubeletServerCertificate": false }, "port": 20250, "serializeImagePulls": false } ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container7 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-controller-manager"] args: ["--feature-gates=RotateKubeletServerCertificate=false"] restartPolicy: OnFailure ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false evictionHard: memory.available: "200Mi" featureGates: RotateKubeletServerCertificate: true ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--feature-gates=RotateKubeletServerCertificate=true"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false evictionHard: memory.available: "200Mi" ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: [""] restartPolicy: OnFailure ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "kind": "KubeletConfiguration", "address": "192.168.0.8", "apiVersion": "kubelet.config.k8s.io/v1beta1", "evictionHard": { "memory.available": "200Mi" }, "featureGates": { "RotateKubeletServerCertificate": true }, "port": 20250, "serializeImagePulls": false } ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "kind": "KubeletConfiguration", "address": "192.168.0.8", "apiVersion": "kubelet.config.k8s.io/v1beta1", "evictionHard": { "memory.available": "200Mi" }, "port": 20250, "serializeImagePulls": false } ``` </details>