<p>I'm running the <strong>CIS kube-bench tool</strong> on the master node and trying to resolve this error</p>
<pre><code>[FAIL] 1.2.6 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Automated). 
</code></pre>
<p>I understand that I need to update the API server manifest YAML file with this flag pointing to the right CA file <strong>--kubelet-certificate-authority</strong> however, I'm not sure which one is the right CA Certififace for Kubelet.</p>
<p>These are my files in the PKI directory:-</p>
<pre><code>apiserver-etcd-client.crt
apiserver-etcd-client.key
apiserver-kubelet-client.crt
apiserver-kubelet-client.key
apiserver.crt
apiserver.key
ca.crt
ca.key
etcd
front-proxy-ca.crt
front-proxy-ca.key
front-proxy-client.crt
front-proxy-client.key
sa.key
sa.pub
</code></pre>

<p>3 very similar discussions on the same topic. I wont provide you all steps cause it well written in documentation and related questions on stack. Only high-level overview</p>
<ol>
<li><a href="https://stackoverflow.com/questions/63994701/how-do-i-properly-set-kubelet-certificate-authority-apiserver-parameter">How Do I Properly Set --kubelet-certificate-authority apiserver parameter?</a></li>
<li><a href="https://stackoverflow.com/questions/64018120/kubernetes-kubelet-certificate-authority-on-premise-with-kubespray-causes-certif">Kubernetes kubelet-certificate-authority on premise with kubespray causes certificate validation error for master node</a></li>
<li><a href="https://github.com/kubernetes-sigs/kubespray/issues/6760#issuecomment-711732503" rel="nofollow noreferrer">Kubernetes kubelet-certificate-authority on premise with kubespray causes certificate validation error for master node</a></li>
</ol>
<p>Your actions:</p>
<ul>
<li>Follow the Kubernetes documentation and setup the <a href="https://kubernetes.io/docs/concepts/architecture/control-plane-node-communication/#apiserver-to-kubelet" rel="nofollow noreferrer">TLS connection between the apiserver and kubelets</a>.</li>
</ul>
<blockquote>
<p>These connections terminate at the kubelet's HTTPS endpoint. <strong>By
default, the apiserver does not verify the kubelet's serving
certificate, which makes the connection subject to man-in-the-middle
attacks</strong> and unsafe to run over untrusted and/or public networks.</p>
</blockquote>
<ul>
<li>Enable <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/#kubelet-authentication" rel="nofollow noreferrer">Kubelet authentication</a> and <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/#kubelet-authorization" rel="nofollow noreferrer">Kubelet authorization</a></li>
</ul>
<p>Then, edit the API server pod specification file <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> on the master node and set the <code>--kubelet-certificate-authority</code> parameter to the <strong>path to the cert file for the certificate authority</strong>.</p>
<hr />
<p>From @Matt <a href="https://stackoverflow.com/a/64025448/9929015">answer</a></p>
<ul>
<li>Use <code>/etc/kubernetes/ssl/ca.crt</code> to sign new certificate for kubelet with valid IP SANs.</li>
<li>Set <code>--kubelet-certificate-authority=/etc/kubernetes/ssl/ca.crt</code> (valid CA).</li>
<li>In <code>/var/lib/kubelet/config.yaml</code> (kubelet config file) set <code>tlsCertFile</code> and <code>tlsPrivateKeyFile</code> to point to newly created kubelet <code>crt</code> and <code>key</code> files.</li>
</ul>
<p>And from <a href="https://github.com/kubernetes-sigs/kubespray/issues/6760#issuecomment-784337506" rel="nofollow noreferrer">clarifications</a>:</p>
<blockquote>
<p>Yes you have to generate certificates for kubelets and sign sign them
the provided certificate authority located here on the master
<code>/etc/kubernetes/ssl/ca.crt</code></p>
</blockquote>
