Skip to main content

Ensure Authorization Mode Argument Includes RBAC

More Info:​

Turn on Role Based Access Control.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, back up the existing kube-apiserver static pod manifest:

    sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak.$(date +%F-%H%M%S)

  2. On every control plane node, open the manifest for editing:

    sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

    Locate the - --authorization-mode=... line under spec.containers[].command. If it does not exist, add it; if it exists, modify it so that it includes RBAC, for example:

    - --authorization-mode=Node,RBAC

    Save and exit. Editing this file will cause the kube-apiserver static pod to restart automatically.

  3. On every control plane node where you changed the file, confirm the kube-apiserver pod has restarted and is running:

    sudo crictl ps | grep kube-apiserver || sudo docker ps | grep kube-apiserver

  4. On every control plane node, verify the kube-apiserver process now includes RBAC in the --authorization-mode argument:

    /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--authorization-mode'

    Confirm the output shows --authorization-mode with a value that includes RBAC (for example, --authorization-mode=Node,RBAC).

Using kubectl

kubectl cannot modify the kube-apiserver static pod manifest or its process flags. This finding must be remediated directly on each control plane node by editing /etc/kubernetes/manifests/kube-apiserver.yaml; see the Manual Steps section for exact instructions.

Automation
#!/usr/bin/env bash
# Purpose: Ensure kube-apiserver --authorization-mode includes RBAC on all control plane nodes
# Scope:   Run on every control plane node (with root privileges)

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
TMP_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml.tmp"

if [[ $EUID -ne 0 ]]; then
  echo "This script must be run as root (it edits ${MANIFEST})." >&2
  exit 1
fi

if [[ ! -f "${MANIFEST}" ]]; then
  echo "Manifest ${MANIFEST} not found; is this a control plane node using static pods?" >&2
  exit 1
fi

echo "Backing up ${MANIFEST} to ${MANIFEST}.$(date +%Y%m%d%H%M%S).bak"
cp -p "${MANIFEST}" "${MANIFEST}.$(date +%Y%m%d%H%M%S).bak"

# Idempotently ensure --authorization-mode includes RBAC
# Handles three cases:
#  1) No --authorization-mode present: add a new arg with 'Node,RBAC'
#  2) Present but missing RBAC: append ",RBAC"
#  3) Present and already includes RBAC: leave unchanged

awk -v OFS="" '
  $0 ~ /--authorization-mode=/ {
    # Process only once
    if (processed == 1) { print; next }
    processed = 1

    line = $0
    # Extract the value after --authorization-mode=
    match(line, /--authorization-mode=([^"[:space:]]*)/, arr)
    if (arr[1] == "") {
      print
      next
    }

    mode = arr[1]
    # If RBAC already present (as a separate item), leave as-is
    split(mode, parts, ",")
    has_rbac = 0
    for (i in parts) {
      if (parts[i] == "RBAC") {
        has_rbac = 1
        break
      }
    }

    if (has_rbac == 1) {
      print
      next
    }

    # Append RBAC
    newmode = mode ",RBAC"
    sub(/--authorization-mode=[^"[:space:]]*/, "--authorization-mode=" newmode, line)
    print line
    next
  }
  { print }
  END {
    if (processed != 1) {
      # Need to add a new arg line under containers.args
      # This is a simple append; we do not attempt to be YAML-aware beyond this.
    }
  }
' "${MANIFEST}" > "${TMP_MANIFEST}"

# If we did not find --authorization-mode at all, append a new arg under containers.args
if ! grep -q -- "--authorization-mode=" "${TMP_MANIFEST}"; then
  echo "No --authorization-mode found; adding --authorization-mode=Node,RBAC under containers.args"

  awk -v OFS="" '
    /name: kube-apiserver/ { in_apiserver = 1 }
    in_apiserver && /args:/ && !in_args {
      in_args = 1
      print
      print "    - --authorization-mode=Node,RBAC"
      next
    }
    { print }
  ' "${TMP_MANIFEST}" > "${TMP_MANIFEST}.with_authmode" || {
    echo "Failed to inject --authorization-mode into manifest." >&2
    exit 1
  }
  mv "${TMP_MANIFEST}.with_authmode" "${TMP_MANIFEST}"
fi

# Replace original manifest (this will trigger a kube-apiserver restart via kubelet static pod management)
mv "${TMP_MANIFEST}" "${MANIFEST}"

echo "Updated ${MANIFEST}. kube-apiserver static pod will be restarted automatically."

echo "Waiting for kube-apiserver process to restart with RBAC in authorization-mode..."
sleep 20

# Verification: ensure RBAC is present in the kube-apiserver --authorization-mode flag
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--authorization-mode=.*RBAC"; then
  echo "Verification succeeded: kube-apiserver is running with --authorization-mode including RBAC."
  /bin/ps -ef | grep kube-apiserver | grep -v grep | sed -n "1p"
else
  echo "Verification FAILED: kube-apiserver process does not show --authorization-mode including RBAC." >&2
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true
  exit 1
fi

Additional Reading:​