Skip to main content

Ensure Authorization Mode Argument Includes Node

More Info:​

Restrict kubelet nodes to reading only objects associated with them.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, open the kube‑apiserver static pod manifest for editing:

    sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

  2. In the spec.containers[0].command list, locate any existing --authorization-mode= entry. Edit it so that it includes Node (and typically RBAC), for example:

    - --authorization-mode=Node,RBAC

    If there is no --authorization-mode line, add one under the other - -- arguments.

  3. Save and exit the editor. The kube-apiserver static pod will be restarted automatically by kubelet when the manifest file changes. Be aware this briefly restarts the API server on this node.

  4. After 30–60 seconds, verify the kube-apiserver process on this control plane node now includes --authorization-mode=Node in its arguments:

    /bin/ps -ef | grep kube-apiserver | grep -v grep

  5. Inspect the output and confirm that the kube-apiserver command line contains an --authorization-mode= flag whose value includes Node (for example, --authorization-mode=Node,RBAC). Repeat these steps on every control plane node.

Using kubectl

kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so this finding cannot be fixed via the Kubernetes API. The required change must be made directly on each control plane node in /etc/kubernetes/manifests/kube-apiserver.yaml; follow the Manual Steps section to perform and verify the fix.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure kube-apiserver --authorization-mode includes Node
# Scope: Run on every control plane node (as root)
# Effect: Editing /etc/kubernetes/manifests/kube-apiserver.yaml will restart the kube-apiserver static pod.

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-authorization-mode-node"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

if [ "$(id -u)" -ne 0 ]; then
  echo "ERROR: This script must be run as root on each control plane node." >&2
  exit 1
fi

if [ ! -f "$MANIFEST" ]; then
  echo "ERROR: kube-apiserver manifest not found at $MANIFEST" >&2
  exit 1
fi

mkdir -p "$BACKUP_DIR"
cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

echo "Updating --authorization-mode in $MANIFEST to ensure it includes Node ..."

python3 - "$MANIFEST" << 'PYEOF'
import sys, ruamel.yaml, os

path = sys.argv[1]
yaml = ruamel.yaml.YAML()
yaml.preserve_quotes = True

with open(path, 'r') as f:
    data = yaml.load(f)

spec = data.get('spec', {})
containers = spec.get('containers', [])

for c in containers:
    if c.get('name') != 'kube-apiserver':
        continue
    args = c.get('command') or c.get('args')
    if not args:
        continue

    # Find and update --authorization-mode flag
    updated = False
    for i, a in enumerate(args):
        if a.startswith('--authorization-mode='):
            modes = a.split('=', 1)[1].split(',')
            modes = [m for m in (m.strip() for m in modes) if m]
            if 'Node' not in modes:
                modes.append('Node')
            # Keep RBAC if present; otherwise leave modes as-is except for added Node
            new_val = '--authorization-mode=' + ','.join(sorted(set(modes), key=modes.index))
            args[i] = new_val
            updated = True
            break

    # If flag missing entirely, append recommended value
    if not updated:
        args.append('--authorization-mode=Node,RBAC')

    # Write back to the correct key
    if 'command' in c:
        c['command'] = args
    else:
        c['args'] = args

with open(path, 'w') as f:
    yaml.dump(data, f)
PYEOF

echo "Manifest updated. kubelet will restart the kube-apiserver static pod automatically."

echo "Verifying kube-apiserver process has --authorization-mode including Node ..."
sleep 10

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode'; then
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode=.*Node'; then
    echo "SUCCESS: kube-apiserver --authorization-mode includes Node:"
    /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^[[:space:]]*//'
    exit 0
  else
    echo "ERROR: kube-apiserver is running without Node in --authorization-mode." >&2
    /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^[[:space:]]*//'
    exit 1
  fi
else
  echo "ERROR: Could not find a running kube-apiserver process to verify." >&2
  exit 1
fi

Additional Reading:​