---
isPrivate: true
title: Client Authentication against the API server and kubelet
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Integrations > FAQ Integrations > Client Authentication against the API
  server and kubelet
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Client Authentication against the API server and kubelet

{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

By default the Agent authenticates against the API server and kubelet with its service account bearer token. If you want to specify its path, set the options below. If X509 client certificates are set, either for the kubelet or API server, they are used instead. The recommended way to [expose these files](https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod) to the Agent is by using [Kubernetes Secrets](https://kubernetes.io/docs/concepts/configuration/secret).

```text
bearer_token_path: /var/run/secrets/kubernetes.io/serviceaccount/token
apiserver_client_crt: /path/to/client.crt
apiserver_client_key: /path/to/client.key
kubelet_client_crt: /path/to/client.crt
kubelet_client_key: /path/to/client.key
```

## Server authentication for API server and kubelet{% #server-authentication-for-api-server-and-kubelet %}

Datadog uses the default CA certificate of the Agent's service account to verify the API server's identity. To use custom certificates, specify the path in your configuration file.

```text
apiserver_ca_cert: /path/to/cacert.crt
kubelet_client_ca: /path/to/ca.pem
```

The default for kubelet traffic is to first try to use the read-only port that doesn't require TLS and then to fall back to the HTTPS API with simple TLS validation. Providing a cert forces TLS validation on. Explicitly disabling tls_verify should be used with caution: if an attacker sniffs the Agent requests they will see the Agent's service account bearer token.

```text
kubelet_tls_verify: True
```

## Alternate option: kubeconfig{% #alternate-option-kubeconfig %}

Alternately, you can use [kubeconfig](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig) for API server authentication. Use the `DD_KUBERNETES_KUBECONFIG_PATH` environment variable to specify the path, or the equivalent option in [datadog.yaml](https://github.com/DataDog/datadog-agent/blob/main/pkg/config/example/datadog-agent_linux.yaml.example).

```text
kubernetes_kubeconfig_path: /path/to/file
```