Our IT department have setup a Kubernetes cluster for our development work using
kops, and we've run
kube-bench on it to see what security issues need to be addressed.
Currently there's a lot of failed checks relating to the certificate authority used inside the cluster, e.g:
[FAIL] 1.1.20 Ensure that the --token-auth-file parameter is not set (Scored) [FAIL] 1.1.21 Ensure that the --kubelet-certificate-authority argument is set as appropriate (Scored) [FAIL] 1.1.22 Ensure that the --kubelet-client-certificate and --kubelet-client-key arguments are set as appropriate (Scored)
How important is it to address those issues? What are the security implications of leaving those checks unaddressed?