> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Authorization Mode Argument Is Not Set Always Allow ### More Info: Do not allow all requests. Enable explicit authorization. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CIS GKE * CMMC 2.0 * CSA Cloud Controls Matrix v4 * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation 1. On every worker node, SSH in and confirm how kubelet is started and where its config lives: ```bash theme={null} ps -ef | grep kubelet ``` If you see a `--config=/var/lib/kubelet/config.yaml` (or similar) argument, proceed with Method 1 below. If you instead see explicit flags like `--authorization-mode=AlwaysAllow`, use Method 2. 2. Method 1 – kubelet config file (`/var/lib/kubelet/config.yaml`):\ a. Back up and edit the config: ```bash theme={null} sudo cp /var/lib/kubelet/config.yaml /var/lib/kubelet/config.yaml.bak sudo vi /var/lib/kubelet/config.yaml ``` b. In the YAML, ensure these sections exist and are set correctly (add or adjust as needed): ```yaml theme={null} authentication: webhook: enabled: true authorization: mode: Webhook ``` c. Save the file. 3. Method 2 – kubelet executable arguments (systemd):\ a. Back up and edit the kubelet systemd drop‑in: ```bash theme={null} sudo cp /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf.bak sudo vi /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf ``` b. In the `KUBELET_ARGS` (or equivalent) line, remove any `--authorization-mode=AlwaysAllow` and ensure these flags are present: ```text theme={null} --authentication-token-webhook \ --authorization-mode=Webhook ``` c. Save the file. 4. On every worker node, reload systemd and restart kubelet (both methods): ```bash theme={null} sudo systemctl daemon-reload sudo systemctl restart kubelet.service sudo systemctl status kubelet -l ``` Ensure the service is `active (running)` and no errors are reported related to the new flags/config. 5. Verification on every worker node (derived from the audit command): ```bash theme={null} /bin/ps -fC kubelet ``` Confirm that: * There is no `--authorization-mode=AlwaysAllow` in the kubelet command line, and * Either the kubelet is using `/var/lib/kubelet/config.yaml` where `authorization.mode: Webhook` is set, or the process flags include `--authorization-mode=Webhook` and `--authentication-token-webhook`. kubectl cannot modify kubelet host-level configuration such as `/var/lib/kubelet/config.yaml` or the kubelet systemd unit and flags on worker nodes. To remediate this finding, you must make the changes directly on each node’s OS (kubelet config file or systemd unit) as described in the Manual Steps section. ```bash theme={null} #!/usr/bin/env bash # # Fix CIS GKE 3.2.2 on every worker node: # Ensure kubelet does NOT use AlwaysAllow and uses Webhook auth/authz instead. # # Run this on EACH WORKER NODE over SSH as root or with sudo. # Safe to re-run: only adds/updates required settings. set -euo pipefail echo "[INFO] Detecting kubelet process and configuration method..." # Locate kubelet process if ! ps -fC kubelet >/dev/null 2>&1; then echo "[ERROR] kubelet process not found on this node. Nothing to fix." exit 1 fi KUBELET_CMDLINE="$(ps -o args= -C kubelet | head -n1 || true)" if [[ -z "${KUBELET_CMDLINE}" ]]; then echo "[ERROR] Unable to read kubelet command line." exit 1 fi echo "[INFO] kubelet command line: ${KUBELET_CMDLINE}" # Determine if kubelet uses a config file (Method 1) or only flags (Method 2) CONFIG_FILE="" if [[ "${KUBELET_CMDLINE}" =~ --config[=[:space:]]([^[:space:]]+) ]]; then CONFIG_FILE="${BASH_REMATCH[1]}" fi SYSTEMD_DROPIN="/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf" USE_METHOD=2 if [[ -n "${CONFIG_FILE}" ]]; then USE_METHOD=1 echo "[INFO] Detected kubelet config file: ${CONFIG_FILE}" else echo "[INFO] No --config flag detected, will use kubelet executable arguments (Method 2)." fi backup_file() { local f="$1" if [[ -f "${f}" ]]; then local ts ts="$(date +%Y%m%d%H%M%S)" local backup="${f}.cisgke-3.2.2.bak.${ts}" cp -p "${f}" "${backup}" echo "[INFO] Backup created: ${backup}" fi } ensure_systemd_reload_needed=0 ####################################### # Method 1: kubelet config file ####################################### if [[ "${USE_METHOD}" -eq 1 ]]; then if [[ ! -f "${CONFIG_FILE}" ]]; then echo "[ERROR] Kubelet config file '${CONFIG_FILE}' not found. Cannot apply Method 1." echo "[INFO] Falling back to Method 2 (kubelet flags via systemd), if available." USE_METHOD=2 else backup_file "${CONFIG_FILE}" echo "[INFO] Ensuring Webhook authentication and authorization in kubelet config file..." # If file appears JSON-like (starts with {), operate with simple JSON-aware edits. # If not JSON, we still attempt structured insertion using jq if available. if command -v jq >/dev/null 2>&1; then TMP="$(mktemp)" trap 'rm -f "${TMP}"' EXIT # Convert to canonical JSON via jq; if fails, treat as plain text. if jq . "${CONFIG_FILE}" >/dev/null 2>&1; then jq ' .authentication.webhook.enabled = true | .authorization.mode = "Webhook" ' "${CONFIG_FILE}" > "${TMP}" mv "${TMP}" "${CONFIG_FILE}" chmod 600 "${CONFIG_FILE}" || true echo "[INFO] Updated kubelet config JSON using jq." else echo "[WARN] kubelet config is not valid JSON; please update manually per benchmark." echo " Set: \"authentication\": { \"webhook\": { \"enabled\": true } }" echo " and: \"authorization\": { \"mode\": \"Webhook\" }" fi else echo "[WARN] jq not installed; cannot safely edit JSON kubelet config automatically." echo " Please manually ensure:" echo " \"authentication\": { \"webhook\": { \"enabled\": true } }" echo " \"authorization\": { \"mode\": \"Webhook\" }" fi ensure_systemd_reload_needed=1 fi fi ####################################### # Method 2: kubelet executable args ####################################### if [[ "${USE_METHOD}" -eq 2 ]]; then if [[ ! -f "${SYSTEMD_DROPIN}" ]]; then echo "[ERROR] Expected systemd drop-in '${SYSTEMD_DROPIN}' not found." echo "[ERROR] Cannot apply Method 2 automatically on this OS layout." echo " Update your kubelet service configuration to include:" echo " --authentication-token-webhook" echo " --authorization-mode=Webhook" exit 1 fi backup_file "${SYSTEMD_DROPIN}" echo "[INFO] Updating kubelet systemd drop-in: ${SYSTEMD_DROPIN}" # Ensure file has a KUBELET_ARGS line; if not, append one. if ! grep -q 'KUBELET_ARGS' "${SYSTEMD_DROPIN}"; then cat <<'EOF' >> "${SYSTEMD_DROPIN}" Environment="KUBELET_ARGS=--authentication-token-webhook --authorization-mode=Webhook" EOF else # Ensure --authentication-token-webhook present if ! grep -q -- '--authentication-token-webhook' "${SYSTEMD_DROPIN}"; then sed -i 's/\(KUBELET_ARGS=.*\)"/\1 --authentication-token-webhook"/' "${SYSTEMD_DROPIN}" || true fi # Ensure --authorization-mode is set to Webhook (replace AlwaysAllow or others) if grep -q -- '--authorization-mode=' "${SYSTEMD_DROPIN}"; then sed -i 's/--authorization-mode=[^" ]*/--authorization-mode=Webhook/g' "${SYSTEMD_DROPIN}" || true else sed -i 's/\(KUBELET_ARGS=.*\)"/\1 --authorization-mode=Webhook"/' "${SYSTEMD_DROPIN}" || true fi fi ensure_systemd_reload_needed=1 fi ####################################### # Restart kubelet (operational impact) ####################################### if [[ "${ensure_systemd_reload_needed}" -eq 1 ]]; then echo "[INFO] Reloading systemd and restarting kubelet (this will briefly disrupt workloads on this node)..." systemctl daemon-reload systemctl restart kubelet.service echo "[INFO] kubelet service status:" systemctl status kubelet -l --no-pager || true fi ####################################### # Verification (adapted from audit) ####################################### echo "[INFO] Verifying that kubelet is NOT using AlwaysAllow and is using Webhook authorization..." KUBELET_CMDLINE_NEW="$(ps -o args= -C kubelet | head -n1 || true)" echo "[INFO] Current kubelet command line: ${KUBELET_CMDLINE_NEW}" if echo "${KUBELET_CMDLINE_NEW}" | grep -q -- '--authorization-mode=AlwaysAllow'; then echo "[FAIL] kubelet is still configured with --authorization-mode=AlwaysAllow" exit 1 fi if echo "${KUBELET_CMDLINE_NEW}" | grep -q -- '--authorization-mode=Webhook'; then echo "[OK] kubelet authorization-mode is set to Webhook via executable arguments." fi if [[ -n "${CONFIG_FILE:-}" && -f "${CONFIG_FILE}" ]]; then echo "[INFO] Checking kubelet config file for Webhook settings: ${CONFIG_FILE}" grep -E '"authorization"[[:space:]]*:' -n "${CONFIG_FILE}" || true grep -E '"mode"[[:space:]]*:[[:space:]]*"Webhook"' -n "${CONFIG_FILE}" || true grep -E '"authentication"[[:space:]]*:' -n "${CONFIG_FILE}" || true grep -E '"webhook"[[:space:]]*:' -n "${CONFIG_FILE}" || true grep -E '"enabled"[[:space:]]*:[[:space:]]*true' -n "${CONFIG_FILE}" || true fi /bin/ps -fC kubelet || true echo "[INFO] CIS GKE 3.2.2 remediation script completed on this node." ``` ### Additional Reading: * [https://kubernetes.io/docs/admin/kubelet/](https://kubernetes.io/docs/admin/kubelet/)