diff --git a/salt/minion/cert/k8s_client_prometheus.yml b/salt/minion/cert/k8s_client_prometheus.yml
index 678ddbe..138fce8 100644
--- a/salt/minion/cert/k8s_client_prometheus.yml
+++ b/salt/minion/cert/k8s_client_prometheus.yml
@@ -10,3 +10,4 @@
           common_name: kubelet-client
           signing_policy: cert_client
           alternative_names: IP:${_param:cluster_vip_address},IP:${_param:cluster_node01_address},IP:${_param:cluster_node02_address},IP:${_param:cluster_node03_address},IP:${_param:kubernetes_internal_api_address}
+          mode: '0444'