Check 4.17

[SeryioGonzalez]

Check 4.1.7 is based on flag --ca-file, but CA FILE can be passed in kubelet-config.yaml

[andypitcher]

@SeryioGonzalez not sure which version of CIS you were referring to, but in general check 4.1.7 Ensure that the certificate authorities file permissions are set to 6XX or more restrictive (Manual), has two possible conditions:

1. Either $CAFILE path is retrieved through the running process definition, with --client-ca-file=.
2. Or $CAFILE value is retrieved from the configmap variable $kubeletcafile, in case the former condition is not fulfilled.

My take is that it's better to validate the confs when they are loaded and used, however it might be relevant also to confirm where they originate from and test this origin (in your case kubelet-config.yaml).