> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet TLS Cert File And TLS Private Key File Arguments Set As Appropriate

### More Info:

The kubelet --tls-cert-file and --tls-private-key-file arguments should be set so the kubelet serves its API over TLS with a valid certificate. Without them, kubelet traffic may be unencrypted.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS OKE

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, check the current kubelet process arguments to confirm the flags are missing or incorrect:
           ```bash theme={null}
           /bin/ps -fC kubelet
           ```

        2. On every worker node, open the kubelet systemd drop-in config for editing:
           ```bash theme={null}
           sudo vi /etc/systemd/system/kubelet.service.d/00-default.conf
           ```

        3. In the opened file, locate the line starting with `ExecStart=` and ensure it includes the following flags (add or correct them within the existing line, preserving other arguments):
           ```text theme={null}
           --tls-cert-file=/var/lib/kubelet/pki/tls.pem \
           --tls-private-key-file=/var/lib/kubelet/pki/tls.key
           ```
           For example, the `ExecStart=` line should contain (example only; keep your other flags):
           ```text theme={null}
           ExecStart=/usr/bin/kubelet ... --tls-cert-file=/var/lib/kubelet/pki/tls.pem --tls-private-key-file=/var/lib/kubelet/pki/tls.key ...
           ```

        4. On every worker node, reload systemd and restart kubelet (this will restart the kubelet and may briefly impact node scheduling/registration):
           ```bash theme={null}
           sudo systemctl daemon-reload
           sudo systemctl restart kubelet.service
           ```

        5. On every worker node, check that kubelet is healthy:
           ```bash theme={null}
           sudo systemctl status kubelet -l
           ```

        6. On every worker node, verify that the kubelet is now running with the correct TLS certificate and key arguments:
           ```bash theme={null}
           /bin/ps -fC kubelet | grep -- '--tls-'
           ```
           Confirm the output shows:
           ```text theme={null}
           --tls-cert-file=/var/lib/kubelet/pki/tls.pem
           --tls-private-key-file=/var/lib/kubelet/pki/tls.key
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify kubelet process flags or host-level config files, so this finding cannot be fixed via Kubernetes API objects. The correction must be done on each worker node’s OS (editing `/etc/systemd/system/kubelet.service.d/00-default.conf` and related files); follow the Manual Steps section for the exact procedure.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediate CIS OKE 3.2.8:
        # Ensure kubelet is started with --tls-cert-file and --tls-private-key-file
        #
        # Run on: every worker node (with root privileges)
        # Usage: sudo ./fix-kubelet-tls.sh

        set -euo pipefail

        KUBELET_DROPIN_DIR="/etc/systemd/system/kubelet.service.d"
        KUBELET_DROPIN_FILE="${KUBELET_DROPIN_DIR}/00-default.conf"
        TLS_CERT_ARG="--tls-cert-file=/var/lib/kubelet/pki/tls.pem"
        TLS_KEY_ARG="--tls-private-key-file=/var/lib/kubelet/pki/tls.key"

        echo "[INFO] Ensuring kubelet systemd drop-in exists at ${KUBELET_DROPIN_FILE}"
        if [ ! -d "${KUBELET_DROPIN_DIR}" ]; then
          mkdir -p "${KUBELET_DROPIN_DIR}"
        fi

        if [ ! -f "${KUBELET_DROPIN_FILE}" ]; then
          echo "[INFO] Creating new ${KUBELET_DROPIN_FILE}"
          cat > "${KUBELET_DROPIN_FILE}" <<'EOF'
        [Service]
        Environment="KUBELET_EXTRA_ARGS="
        EOF
        fi

        echo "[INFO] Making ${KUBELET_DROPIN_FILE} idempotent for KUBELET_EXTRA_ARGS"

        # Ensure there is a single KUBELET_EXTRA_ARGS Environment line
        if grep -q '^Environment="KUBELET_EXTRA_ARGS=' "${KUBELET_DROPIN_FILE}"; then
          :
        else
          echo '[Service]' >> "${KUBELET_DROPIN_FILE}"
          echo 'Environment="KUBELET_EXTRA_ARGS="' >> "${KUBELET_DROPIN_FILE}"
        fi

        # Normalize file to avoid multiple duplicates of the TLS args
        TMP_FILE="$(mktemp)"
        trap 'rm -f "${TMP_FILE}"' EXIT

        while IFS= read -r line; do
          if [[ "${line}" =~ ^Environment=\"KUBELET_EXTRA_ARGS= ]]; then
            # Strip trailing quote, ensure space-separated args
            current="${line#Environment=\"KUBELET_EXTRA_ARGS=}"
            current="${current%\"}"

            # Remove any existing tls-cert-file / tls-private-key-file flags
            # shellcheck disable=SC2206
            args=(${current})
            new_args=()
            for a in "${args[@]}"; do
              case "${a}" in
                --tls-cert-file=*|--tls-private-key-file=*)
                  # skip old values
                  ;;
                *)
                  new_args+=("${a}")
                  ;;
              esac
            done

            # Append required arguments
            new_args+=("${TLS_CERT_ARG}" "${TLS_KEY_ARG}")

            # Reconstruct line
            joined="$(printf '%s ' "${new_args[@]}")"
            joined="${joined%" "}"
            echo "Environment=\"KUBELET_EXTRA_ARGS=${joined}\"" >> "${TMP_FILE}"
          else
            echo "${line}" >> "${TMP_FILE}"
          fi
        done < "${KUBELET_DROPIN_FILE}"

        mv "${TMP_FILE}" "${KUBELET_DROPIN_FILE}"

        echo "[INFO] Reloading systemd and restarting kubelet (this will restart kubelet)"
        systemctl daemon-reload
        systemctl restart kubelet.service

        echo "[INFO] Checking kubelet status"
        systemctl status kubelet -l --no-pager || true

        echo "[INFO] Verifying kubelet process flags for TLS settings"
        /bin/ps -fC kubelet || {
          echo "[ERROR] kubelet process not found after restart"
          exit 1
        }

        if /bin/ps -fC kubelet | grep -q "${TLS_CERT_ARG}" && \
           /bin/ps -fC kubelet | grep -q "${TLS_KEY_ARG}"; then
          echo "[SUCCESS] kubelet is running with ${TLS_CERT_ARG} and ${TLS_KEY_ARG}"
          exit 0
        else
          echo "[ERROR] kubelet is NOT running with required TLS flags."
          echo "Current kubelet command line:"
          /bin/ps -fC kubelet || true
          exit 2
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>