Ensure Authorization Mode Argument Is Not Set Always Allow

More Info:

Do not allow all requests. Enable explicit authorization.

Risk Level

Medium

Address

Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CIS EKS
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Manual Steps

1. SSH to each worker node and identify kubelet config source

   ssh ec2-user@<worker-node-ip>
   ps -ef | grep '[k]ubelet'

   • In the kubelet process output, look for either:
     • --config=/var/lib/kubelet/config.yaml (config file), and/or
     • --authorization-mode=... / --authentication-token-webhook (exec args).

2. If using kubelet config file /var/lib/kubelet/config.yaml (or the path found in step 1), edit it

   sudo vi /var/lib/kubelet/config.yaml

   In the YAML, ensure these sections exist and are set correctly (create them if missing):

   authentication:
     webhook:
       enabled: true
   
   authorization:
     mode: Webhook

   Ensure there is no AlwaysAllow value under authorization:.

3. If using executable arguments via systemd drop-in, edit kubelet args

   sudo vi /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf

   In the KUBELET_ARGS (or equivalent) line, ensure it includes:

   --authentication-token-webhook \
   --authorization-mode=Webhook

   and remove any occurrence of:

   --authorization-mode=AlwaysAllow

4. Reload systemd and restart kubelet (kubelet will restart; pods on this node may be rescheduled)

   sudo systemctl daemon-reload
   sudo systemctl restart kubelet.service

5. Confirm kubelet is healthy

   sudo systemctl status kubelet -l

6. Verify the fix on each worker node

   /bin/ps -fC kubelet

   • Confirm:

     • The command line does not contain --authorization-mode=AlwaysAllow.
     • If --authorization-mode is present, it is set to Webhook.

   • If using config file, optionally inspect to reconfirm:

     sudo grep -A3 -E 'authentication:|authorization:' /var/lib/kubelet/config.yaml

Using kubectl

kubectl cannot change the kubelet’s --authorization-mode or its /var/lib/kubelet/config.yaml settings, because these are host-level flags and config files on every worker node. To remediate this finding, make the changes directly on each node’s kubelet configuration or systemd unit as described in the Manual Steps section.

Automation

#!/usr/bin/env bash
#
# Fix CISEKS 3.2.2 on every worker node:
# - Ensure kubelet does NOT use --authorization-mode=AlwaysAllow
# - Ensure kubelet uses webhook authn/authz via config file or flags
#
# Run this script on: every worker node (over SSH or via your node-management tool)
# Safe to re-run: idempotent edits, backups retained.

set -euo pipefail

BACKUP_SUFFIX=".cis-3.2.2.bak.$(date +%s)"
SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf"

echo "[*] Starting remediation for kubelet authorization mode on worker node: $(hostname)"

#-----------------------------
# Helper: backup a file once
#-----------------------------
backup_file() {
  local f="$1"
  if [[ -f "$f" && ! -f "${f}.cis-3.2.2.backup" ]]; then
    cp -p "$f" "${f}.cis-3.2.2.backup"
    echo "    Backed up $f to ${f}.cis-3.2.2.backup"
  fi
}

#-----------------------------
# Detect kubelet process, config path, and flags
#-----------------------------
echo "[*] Detecting kubelet process and configuration..."

if ! pgrep -x kubelet >/dev/null 2>&1; then
  echo "ERROR: kubelet process not found on this node. Aborting."
  exit 1
fi

# Get full command line
KUBELET_CMDLINE="$(ps -fC kubelet --no-headers || true)"
echo "    kubelet cmdline: $KUBELET_CMDLINE"

# Extract --config value if present
KUBELET_CONFIG_PATH=""
if echo "$KUBELET_CMDLINE" | grep -q -- '--config='; then
  KUBELET_CONFIG_PATH="$(echo "$KUBELET_CMDLINE" \
    | sed -n 's/.*--config=\([^[:space:]]*\).*/\1/p' | head -n1)"
elif echo "$KUBELET_CMDLINE" | grep -q -- '--config '; then
  # handle '--config /path' style if present
  KUBELET_CONFIG_PATH="$(echo "$KUBELET_CMDLINE" \
    | sed -n 's/.*--config[[:space:]]\+\/\([^[:space:]]*\).*/\/\1/p' | head -n1)"
fi

if [[ -n "$KUBELET_CONFIG_PATH" ]]; then
  echo "    Detected kubelet config file: $KUBELET_CONFIG_PATH"
else
  echo "    No --config flag detected; will remediate via systemd flags (if present)."
fi

#-----------------------------
# Method 1: Kubelet config file remediation
#-----------------------------
if [[ -n "$KUBELET_CONFIG_PATH" && -f "$KUBELET_CONFIG_PATH" ]]; then
  echo "[*] Applying remediation via kubelet config file: $KUBELET_CONFIG_PATH"
  backup_file "$KUBELET_CONFIG_PATH"

  # Ensure authentication.webhook.enabled: true
  if grep -q 'authentication:' "$KUBELET_CONFIG_PATH"; then
    # Ensure webhook section exists
    if ! grep -q 'webhook:' "$KUBELET_CONFIG_PATH"; then
      echo "    Adding authentication.webhook section..."
      # Append under authentication: (simple YAML injection; assumes 2-space indent)
      awk '
        /^authentication:/ {
          print;
          print "  webhook:";
          print "    enabled: true";
          next
        }
        { print }
      ' "$KUBELET_CONFIG_PATH" > "${KUBELET_CONFIG_PATH}${BACKUP_SUFFIX}.tmp"
      mv "${KUBELET_CONFIG_PATH}${BACKUP_SUFFIX}.tmp" "$KUBELET_CONFIG_PATH"
    else
      # Set enabled: true (idempotent)
      echo "    Ensuring authentication.webhook.enabled is true..."
      python3 - "$KUBELET_CONFIG_PATH" <<'PYEOF'
import sys, ruamel.yaml
path = sys.argv[1]
yaml = ruamel.yaml.YAML()
data = yaml.load(open(path))
auth = data.setdefault('authentication', {})
wh = auth.setdefault('webhook', {})
wh['enabled'] = True
with open(path, 'w') as f:
    yaml.dump(data, f)
PYEOF
    fi
  else
    echo "    Adding authentication section with webhook enabled..."
    cat <<'EOF' >> "$KUBELET_CONFIG_PATH"

authentication:
  webhook:
    enabled: true
EOF
  fi

  # Ensure authorization.mode: Webhook
  echo "    Ensuring authorization.mode is set to Webhook..."
  python3 - "$KUBELET_CONFIG_PATH" <<'PYEOF'
import sys, ruamel.yaml
path = sys.argv[1]
yaml = ruamel.yaml.YAML()
data = yaml.load(open(path))
authz = data.setdefault('authorization', {})
authz['mode'] = 'Webhook'
with open(path, 'w') as f:
    yaml.dump(data, f)
PYEOF

else
  echo "[*] Kubelet config file not available; skipping Method 1."
fi

#-----------------------------
# Method 2: systemd kubelet flags remediation
#-----------------------------
if systemctl list-unit-files | grep -q '^kubelet\.service'; then
  echo "[*] Applying remediation via systemd kubelet flags at $SYSTEMD_DROPIN"
  mkdir -p "$(dirname "$SYSTEMD_DROPIN")"
  if [[ -f "$SYSTEMD_DROPIN" ]]; then
    backup_file "$SYSTEMD_DROPIN"
  fi

  # If drop-in exists, edit; else create with safe defaults
  if [[ -f "$SYSTEMD_DROPIN" ]]; then
    # Remove explicit AlwaysAllow if present and ensure webhook flags
    tmp="${SYSTEMD_DROPIN}${BACKUP_SUFFIX}.tmp"
    sed -E '
      s/--authorization-mode=AlwaysAllow[[:space:]]*//g
    ' "$SYSTEMD_DROPIN" > "$tmp"

    # Ensure --authorization-mode=Webhook is present
    if ! grep -q -- '--authorization-mode=Webhook' "$tmp"; then
      sed -i 's#ExecStart=#ExecStart=--authorization-mode=Webhook #;t; s#kubelet#kubelet --authorization-mode=Webhook#' "$tmp"
    fi

    # Ensure --authentication-token-webhook is present
    if ! grep -q -- '--authentication-token-webhook' "$tmp"; then
      sed -i 's#kubelet#kubelet --authentication-token-webhook#' "$tmp"
    fi

    mv "$tmp" "$SYSTEMD_DROPIN"
  else
    cat > "$SYSTEMD_DROPIN" <<'EOF'
[Service]
Environment="KUBELET_AUTHZ_ARGS=--authentication-token-webhook --authorization-mode=Webhook"
EOF
  fi
else
  echo "WARNING: kubelet.service not managed by systemd here; Method 2 not applied."
fi

#-----------------------------
# Restart kubelet (systemd)
#-----------------------------
if systemctl list-unit-files | grep -q '^kubelet\.service'; then
  echo "[*] Restarting kubelet via systemd (this will temporarily disrupt workloads on this node)..."
  systemctl daemon-reload
  systemctl restart kubelet.service
  sleep 5
  systemctl status kubelet -l --no-pager || {
    echo "ERROR: kubelet failed to start after remediation."
    exit 1
  }
else
  echo "NOTE: Non-systemd kubelet; restart it using your OS/service manager."
fi

#-----------------------------
# Verification
#-----------------------------
echo "[*] Verifying remediation..."

# 1) Ensure kubelet is not using AlwaysAllow
if /bin/ps -fC kubelet | grep -q -- '--authorization-mode=AlwaysAllow'; then
  echo "ERROR: kubelet is still using --authorization-mode=AlwaysAllow"
  /bin/ps -fC kubelet
  exit 1
fi

# 2) Ensure webhook auth flags/config effective
echo "    kubelet process after restart:"
/bin/ps -fC kubelet

echo "[*] Verification passed: kubelet no longer uses AlwaysAllow and is configured for webhook authentication/authorization (where supported)."

Additional Reading:

• https://kubernetes.io/docs/admin/kubelet/