Kubelet Anonymous Auth Set To False

More Info:

Anonymous authentication should be disabled on the kubelet so that unauthenticated requests are rejected. Enabling it allows anonymous, unauthenticated access to the kubelet API.

Risk Level

Critical

Address

Security

Compliance Standards

• CIS AKS

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every worker node, open the kubelet config file and ensure anonymous auth is disabled:

sudo vi /var/lib/kubelet/config.yaml

Find (or add if missing) the following section and set it exactly like this:

authentication:
  anonymous:
    enabled: false

Save and exit.

2. If the kubelet is also configured via systemd flags, ensure no conflicting --anonymous-auth flag is present:

sudo grep -R -- '--anonymous-auth' /etc/systemd/system /usr/lib/systemd/system || echo "no kubelet anonymous-auth flag found"

If you see a kubelet unit drop-in with --anonymous-auth=true, edit it:

sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf

In the line that defines kubelet arguments, set or add:

--anonymous-auth=false

Save and exit.

3. Reload systemd and restart kubelet on that worker node:

sudo systemctl daemon-reload
sudo systemctl restart kubelet.service

4. Verify the kubelet process is running with anonymous auth disabled on that worker node:

/bin/ps -fC kubelet

Check the output for either --anonymous-auth=false or confirm there is no --anonymous-auth=true flag and anonymous auth is disabled via /var/lib/kubelet/config.yaml as edited in step 1.

Using kubectl

kubectl cannot change kubelet process flags or its config file, so this finding cannot be remediated via the Kubernetes API. The fix must be applied directly on each worker node’s host configuration (for example /var/lib/kubelet/config.yaml and the kubelet systemd unit); see the Manual Steps section for details.

Automation

#!/usr/bin/env bash
#
# Disable kubelet anonymous authentication via /var/lib/kubelet/config.yaml
# Applies to: every worker node
# Usage: run as root on each worker node (safe to re-run)

set -euo pipefail

KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
SYSTEMD_UNIT="kubelet.service"

echo "[INFO] Ensuring kubelet anonymous-auth is disabled using ${KUBELET_CONFIG}"

if [[ ! -f "${KUBELET_CONFIG}" ]]; then
  echo "[ERROR] ${KUBELET_CONFIG} not found. This script assumes kubelet uses a config file."
  echo "[ERROR] If kubelet is configured only via flags, adjust /etc/systemd/system/kubelet.service.d/10-kubeadm.conf manually."
  exit 1
fi

# Ensure yq is available (for safe YAML edits); install instructions are environment-specific
if ! command -v yq >/dev/null 2>&1; then
  echo "[ERROR] 'yq' is required but not installed. Install yq v4+ and re-run."
  exit 1
fi

echo "[INFO] Backing up existing kubelet config to ${KUBELET_CONFIG}.bak-$(date +%Y%m%d%H%M%S)"
cp "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.bak-$(date +%Y%m%d%H%M%S)"

# Idempotently set authentication.anonymous.enabled = false
TMP_FILE="$(mktemp)"
yq '.authentication.anonymous.enabled = false' "${KUBELET_CONFIG}" > "${TMP_FILE}"
mv "${TMP_FILE}" "${KUBELET_CONFIG}"

echo "[INFO] Reloading systemd and restarting kubelet (this will restart the kubelet)"
systemctl daemon-reload
systemctl restart "${SYSTEMD_UNIT}"

echo "[INFO] Waiting for kubelet to be active..."
systemctl is-active --quiet "${SYSTEMD_UNIT}"
echo "[INFO] kubelet is active"

echo "[INFO] Verifying kubelet anonymous-auth is disabled in config..."
yq '.authentication.anonymous.enabled' "${KUBELET_CONFIG}"

echo "[INFO] Verifying running kubelet process and looking for any conflicting --anonymous-auth flags..."
/bin/ps -fC kubelet || true

echo "[INFO] If any --anonymous-auth=true flag appears in the process output above, remove it from:"
echo "       /etc/systemd/system/kubelet.service.d/10-kubeadm.conf and restart kubelet again."