How do I install the Cis K8S V200 1.3.6 skill?

Run npx skillmds@latest add cyberstrikeus/cis-k8s-v200-1-3-6 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis K8S V200 1.3.6 skill do?

Ensure that the RotateKubeletServerCertificate argument is set to true (Automated) It is listed under DevOps & Infra on SkillMD.

Is Cis K8S V200 1.3.6 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis K8S V200 1.3.6?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis K8S V200 1.3.6 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis K8S V200 1.3.6?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis K8S V200 1.3.6 by cyberstrikeus

Name: Cis K8S V200 1.3.6
Author: cyberstrikeus

File contents

CIS Kubernetes Benchmark v2.0.0 - Control 1.3.6

Profile Applicability

Level: 1 - Master Node

Description

Enable kubelet server certificate rotation on controller-manager.

Rationale

RotateKubeletServerCertificate causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad.

Note: This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself.

Impact

None

Audit Procedure

Run the following command on the Control Plane node:

ps -ef | grep kube-controller-manager

Verify that RotateKubeletServerCertificate argument exists and is set to true.

Remediation

Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the Control Plane node and set the --feature-gates parameter to include RotateKubeletServerCertificate=true.

--feature-gates=RotateKubeletServerCertificate=true

Default Value

By default, RotateKubeletServerCertificate is set to "true" this recommendation verifies that it has not been disabled.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	3.10 Encrypt Sensitive Data in TransitEncrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH).		●	●
v7	14.4 Encrypt All Sensitive Information in TransitEncrypt all sensitive information in transit.		●	●

Profile

Level 1 - Master Node (Automated)

---name: cis-k8s-v200-1-3-6description: Ensure that the RotateKubeletServerCertificate argument is set to true (Automated)---# CIS Kubernetes Benchmark v2.0.0 - Control 1.3.6## Profile Applicability- **Level:** 1 - Master Node## DescriptionEnable kubelet server certificate rotation on controller-manager.## Rationale`RotateKubeletServerCertificate` causes the kubelet to both request a serving certificate after bootstrapping its client credentials and rotate the certificate as its existing credentials expire. This automated periodic rotation ensures that the there are no downtimes due to expired certificates and thus addressing availability in the CIA security triad.Note: This recommendation only applies if you let kubelets get their certificates from the API server. In case your kubelet certificates come from an outside authority/tool (e.g. Vault) then you need to take care of rotation yourself.## ImpactNone## Audit ProcedureRun the following command on the Control Plane node:```bashps -ef | grep kube-controller-manager```Verify that `RotateKubeletServerCertificate` argument exists and is set to `true`.## RemediationEdit the Controller Manager pod specification file `/etc/kubernetes/manifests/kube-controller-manager.yaml` on the Control Plane node and set the `--feature-gates` parameter to include `RotateKubeletServerCertificate=true`.```--feature-gates=RotateKubeletServerCertificate=true```## Default ValueBy default, `RotateKubeletServerCertificate` is set to "true" this recommendation verifies that it has not been disabled.## References1. https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/#approval-controller2. https://github.com/kubernetes/features/issues/2673. https://github.com/kubernetes/kubernetes/pull/450594. https://kubernetes.io/docs/admin/kube-controller-manager/## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- || v8 | 3.10 Encrypt Sensitive Data in Transit<br/>Encrypt sensitive data in transit. Example implementations can include: Transport Layer Security (TLS) and Open Secure Shell (OpenSSH). | | ● | ● || v7 | 14.4 Encrypt All Sensitive Information in Transit<br/>Encrypt all sensitive information in transit. | | ● | ● |## Profile**Level 1 - Master Node** (Automated)

Frequently asked questions

Cis K8S V200 1.3.6