> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Authorization Mode Argument Includes Node

### More Info:

Restrict kubelet nodes to reading only objects associated with them.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, open the kube‑apiserver static pod manifest for editing:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        2. In the `spec.containers[0].command` list, locate any existing `--authorization-mode=` entry. Edit it so that it includes `Node` (and typically `RBAC`), for example:
           ```yaml theme={null}
           - --authorization-mode=Node,RBAC
           ```
           If there is no `--authorization-mode` line, add one under the other `- --` arguments.

        3. Save and exit the editor. The kube-apiserver static pod will be restarted automatically by kubelet when the manifest file changes. Be aware this briefly restarts the API server on this node.

        4. After 30–60 seconds, verify the kube-apiserver process on this control plane node now includes `--authorization-mode=Node` in its arguments:
           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep
           ```

        5. Inspect the output and confirm that the `kube-apiserver` command line contains an `--authorization-mode=` flag whose value includes `Node` (for example, `--authorization-mode=Node,RBAC`). Repeat these steps on every control plane node.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so this finding cannot be fixed via the Kubernetes API. The required change must be made directly on each control plane node in `/etc/kubernetes/manifests/kube-apiserver.yaml`; follow the Manual Steps section to perform and verify the fix.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation: Ensure kube-apiserver --authorization-mode includes Node
        # Scope: Run on every control plane node (as root)
        # Effect: Editing /etc/kubernetes/manifests/kube-apiserver.yaml will restart the kube-apiserver static pod.

        set -euo pipefail

        MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-authorization-mode-node"
        TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

        if [ "$(id -u)" -ne 0 ]; then
          echo "ERROR: This script must be run as root on each control plane node." >&2
          exit 1
        fi

        if [ ! -f "$MANIFEST" ]; then
          echo "ERROR: kube-apiserver manifest not found at $MANIFEST" >&2
          exit 1
        fi

        mkdir -p "$BACKUP_DIR"
        cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

        echo "Updating --authorization-mode in $MANIFEST to ensure it includes Node ..."

        python3 - "$MANIFEST" << 'PYEOF'
        import sys, ruamel.yaml, os

        path = sys.argv[1]
        yaml = ruamel.yaml.YAML()
        yaml.preserve_quotes = True

        with open(path, 'r') as f:
            data = yaml.load(f)

        spec = data.get('spec', {})
        containers = spec.get('containers', [])

        for c in containers:
            if c.get('name') != 'kube-apiserver':
                continue
            args = c.get('command') or c.get('args')
            if not args:
                continue

            # Find and update --authorization-mode flag
            updated = False
            for i, a in enumerate(args):
                if a.startswith('--authorization-mode='):
                    modes = a.split('=', 1)[1].split(',')
                    modes = [m for m in (m.strip() for m in modes) if m]
                    if 'Node' not in modes:
                        modes.append('Node')
                    # Keep RBAC if present; otherwise leave modes as-is except for added Node
                    new_val = '--authorization-mode=' + ','.join(sorted(set(modes), key=modes.index))
                    args[i] = new_val
                    updated = True
                    break

            # If flag missing entirely, append recommended value
            if not updated:
                args.append('--authorization-mode=Node,RBAC')

            # Write back to the correct key
            if 'command' in c:
                c['command'] = args
            else:
                c['args'] = args

        with open(path, 'w') as f:
            yaml.dump(data, f)
        PYEOF

        echo "Manifest updated. kubelet will restart the kube-apiserver static pod automatically."

        echo "Verifying kube-apiserver process has --authorization-mode including Node ..."
        sleep 10

        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode'; then
          if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--authorization-mode=.*Node'; then
            echo "SUCCESS: kube-apiserver --authorization-mode includes Node:"
            /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^[[:space:]]*//'
            exit 0
          else
            echo "ERROR: kube-apiserver is running without Node in --authorization-mode." >&2
            /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^[[:space:]]*//'
            exit 1
          fi
        else
          echo "ERROR: Could not find a running kube-apiserver process to verify." >&2
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/authorization/node/](https://kubernetes.io/docs/admin/authorization/node/)