STIGQter: STIG Summary: Kubernetes Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Apr 2026:

Kubernetes Kubelet must enable tlsPrivateKeyFile for client authentication to secure service.

DISA Rule

SV-242424r1043178_rule

Vulnerability Number

V-242424

Group Title

SRG-APP-000219-CTR-000550

Rule Version

CNTR-K8-001460

Severity

CAT II

CCI(s)

• CCI-001184 - Protect the authenticity of communications sessions.

Weight

10

Fix Recommendation

On the Control Plane, run the command:
ps -ef | grep kubelet

Remove the "--tls-private-key-file" option if present.

Note the path to the config file (identified by --config).

Edit the Kubernetes Kubelet config file:
Set "tlsPrivateKeyFile" to a path containing the appropriate private key.

Restart the kubelet service using the following command:
systemctl daemon-reload && systemctl restart kubelet

Check Contents

On the Control Plane, run the command:
ps -ef | grep kubelet

If the "--tls-private-key-file" option exists, this is a finding.

Note the path to the config file (identified by --config).

Run the command:
grep -i tlsPrivateKeyFile <path_to_config_file>

If the setting "tlsPrivateKeyFile" is not set or contains no value, this is a finding.

Vulnerability Number

V-242424

Documentable

False

Rule Version

CNTR-K8-001460

Severity Override Guidance

On the Control Plane, run the command:
ps -ef | grep kubelet

If the "--tls-private-key-file" option exists, this is a finding.

Note the path to the config file (identified by --config).

Run the command:
grep -i tlsPrivateKeyFile <path_to_config_file>

If the setting "tlsPrivateKeyFile" is not set or contains no value, this is a finding.

Check Content Reference

M

Target Key

5376