Skip to main content

Ensure Anonymous Auth Argument Is Disabled

More Info:​

Disable anonymous requests to the Kubelet server.

Risk Level​

High

Address​

Security

Compliance Standards​

  • APRA CPS 234 (Australia)
  • BSI C5 (Germany)
  • Brazil LGPD
  • CCPA / CPRA (California)
  • CIS AKS
  • CIS Critical Security Controls v8
  • CMMC 2.0
  • CSA Cloud Controls Matrix v4
  • DPDPA
  • Digital Operational Resilience Act (EU)
  • Essential 8
  • ISO/IEC 27017
  • ISO/IEC 27018
  • ISO/IEC 27701
  • KSA PDPL
  • MAS Technology Risk Management (Singapore)
  • MITRE ATT&CK (Cloud)
  • NIS2 Directive
  • NIST SP 800-171
  • NYDFS 23 NYCRR 500
  • SWIFT Customer Security Controls Framework
  • Sarbanes-Oxley IT General Controls
  • UK NCSC Cyber Assessment Framework

Triage and Remediation​

Remediation​

Manual Steps

  1. On every worker node, open the Kubelet config file and ensure anonymous auth is disabled:

    sudo sed -i '/^authentication:/,/^[^ ]/ s/anonymous:[[:space:]]*enabled:.*/  anonymous:\n    enabled: false/' /var/lib/kubelet/config.yaml

    Then manually review and, if needed, correct the block so it looks like:

    authentication:
      anonymous:
        enabled: false

  2. If the node also uses kubelet command‑line flags via systemd, ensure --anonymous-auth=false is set:

    sudo sed -i 's/--anonymous-auth=[^ ]*//g' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
    grep -q -- '--anonymous-auth=false' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf || \
    sudo sed -i 's#^\(KUBELET_KUBEADM_ARGS=".*\)"#\1 --anonymous-auth=false"#' /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

  3. Reload systemd configuration and restart kubelet on each worker node:

    sudo systemctl daemon-reload
    sudo systemctl restart kubelet.service

  4. Verify the kubelet process on each worker node is running with anonymous auth disabled:

    /bin/ps -fC kubelet

    Confirm either that --anonymous-auth=false appears in the kubelet command line, or rely on the updated /var/lib/kubelet/config.yaml with the authentication.anonymous.enabled: false setting and no conflicting --anonymous-auth flag.

Using kubectl

kubectl cannot modify Kubelet process flags or its config file on worker nodes, so this finding cannot be fixed through the Kubernetes API. Update /var/lib/kubelet/config.yaml or the kubelet systemd unit on every worker node as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
# Purpose: Disable anonymous authentication on kubelet via /var/lib/kubelet/config.yaml
# Scope:   Run on every worker node (as root). Safe to re-run.

set -euo pipefail

CONFIG_FILE="/var/lib/kubelet/config.yaml"

echo "==> Ensuring kubelet anonymous-auth is disabled on this node"

if [[ ! -f "$CONFIG_FILE" ]]; then
  echo "ERROR: $CONFIG_FILE not found. This node is not using a kubelet config file at that path."
  echo "       Review kubelet startup flags or unit file manually."
  exit 1
fi

# Backup once per day (kept with timestamp, does not overwrite existing backups)
BACKUP_FILE="${CONFIG_FILE}.$(date +%Y%m%d-%H%M%S).bak"
cp "$CONFIG_FILE" "$BACKUP_FILE"
echo "Backup created at $BACKUP_FILE"

# Ensure 'authentication:' block exists
if ! grep -qE '^[[:space:]]*authentication:' "$CONFIG_FILE"; then
  cat <<'EOF' >>"$CONFIG_FILE"

authentication:
  anonymous:
    enabled: false
EOF
  echo "Added authentication/anonymous block to $CONFIG_FILE"
else
  # Ensure 'anonymous:' block exists under 'authentication:'
  if ! awk '/^[[:space:]]*authentication:/ {found=1} found && /^[^[:space:]]/ && !/authentication:/ {found=0} found && /anonymous:/ {print; exit}' "$CONFIG_FILE" >/dev/null; then
    # Insert anonymous block under authentication:
    awk '
      /^[[:space:]]*authentication:/ {
        print
        print "  anonymous:"
        print "    enabled: false"
        next
      }
      { print }
    ' "$CONFIG_FILE" > "${CONFIG_FILE}.tmp"
    mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"
    echo "Added anonymous block under authentication in $CONFIG_FILE"
  else
    # Set enabled: false in existing anonymous block
    awk '
      /^[[:space:]]*authentication:/ {inauth=1}
      inauth && /^[^[:space:]]/ && !/authentication:/ {inauth=0}
      inauth && /^[[:space:]]*anonymous:/ {inanon=1}
      inanon && /^[[:space:]]*enabled:/ {
        sub(/enabled:.*/, "enabled: false")
        inanon=0
      }
      { print }
    ' "$CONFIG_FILE" > "${CONFIG_FILE}.tmp"
    mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"
    echo "Set authentication.anonymous.enabled to false in $CONFIG_FILE"
  fi
fi

# Restart kubelet to apply changes
echo "==> Restarting kubelet"
systemctl daemon-reload
systemctl restart kubelet.service

sleep 5

# Verification using the audit method (process inspection) and config content
echo "==> Verifying kubelet process and configuration"

if ! /bin/ps -fC kubelet; then
  echo "ERROR: kubelet process not found after restart."
  exit 1
fi

echo
echo "Current authentication.anonymous section in $CONFIG_FILE:"
grep -n -A2 -B1 'anonymous' "$CONFIG_FILE" || echo "No anonymous block found (which is acceptable as long as CLI flag is false)."

# Extra verification: check effective anonymous setting from config file
if grep -qE '^[[:space:]]*authentication:[[:space:]]*$' "$CONFIG_FILE"; then
  if grep -A3 -E '^[[:space:]]*authentication:[[:space:]]*$' "$CONFIG_FILE" | grep -A2 'anonymous:' | grep -q 'enabled:[[:space:]]*false'; then
    echo "SUCCESS: authentication.anonymous.enabled is set to false in $CONFIG_FILE"
    exit 0
  fi
fi

echo "WARNING: Could not confirm authentication.anonymous.enabled: false from $CONFIG_FILE."
echo "Review kubelet unit flags and configuration manually."
exit 1

Additional Reading:​