Project: KICS (Provisioning / Security & Compliance)
File: e0e00aba-5f1c-4981-a542-9a9563c0ee20.md

title: Client Certificate Authentication Not Setup Properly hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: e0e00aba-5f1c-4981-a542-9a9563c0ee20 Query name: Client Certificate Authentication Not Setup Properly Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: Client Certificate Authentication should be Setup with a .pem or .crt file<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--client-ca-file=/var/lib/ca.txt"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--client-ca-file=/var/lib/ca.txt"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="2" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 protectKernelDefaults: false serializeImagePulls: false authentication: anonymous: enabled: false webhook: enabled: true x509: clientCAFile: "/var/lib/kubernetes/ca.txt" authorization: evictionHard: memory.available: "200Mi" ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="2" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 protectKernelDefaults: false serializeImagePulls: false authentication: anonymous: enabled: false webhook: enabled: true authorization: evictionHard: memory.available: "200Mi" ``` </details> <details><summary>Positive test num. 6 - yaml file</summary> ```yaml hl_lines="2" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 protectKernelDefaults: false serializeImagePulls: false evictionHard: memory.available: "200Mi" ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--client-ca-file=/var/lib/ca.pem"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--client-ca-file=/var/lib/ca.pem"] restartPolicy: OnFailure ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 protectKernelDefaults: false serializeImagePulls: false authentication: anonymous: enabled: false webhook: enabled: true x509: clientCAFile: "/var/lib/kubernetes/ca.pem" authorization: evictionHard: memory.available: "200Mi" ``` </details> <details><summary>Negative test num. 5 - json file</summary> ```json { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "port": 10250, "readOnlyPort": 10255, "cgroupDriver": "cgroupfs", "hairpinMode": "promiscuous-bridge", "serializeImagePulls": false, "authentication":{ "anonymous":{ "enabled": false }, "webhook":{ "enabled": true }, "x509":{ "clientCAFile":"/var/lib/kubernetes/ca.pem" } }, "featureGates": { "RotateKubeletClientCertificate": true, "RotateKubeletServerCertificate": true } } ``` </details> <details><summary>Negative test num. 6 - yaml file</summary> ```yaml apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--client-ca-file=/var/lib/ca.crt"] restartPolicy: OnFailure ``` </details> <details><summary>Negative test num. 7 - yaml file</summary> ```yaml apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 protectKernelDefaults: false serializeImagePulls: false authentication: anonymous: enabled: false webhook: enabled: true x509: clientCAFile: "/var/lib/kubernetes/ca.crt" authorization: evictionHard: memory.available: "200Mi" ``` </details>