> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Authorization Mode Argument Includes RBAC

### More Info:

Turn on Role Based Access Control.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, back up the existing kube-apiserver static pod manifest:
           ```bash theme={null}
           sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak.$(date +%F-%H%M%S)
           ```

        2. On every control plane node, open the manifest for editing:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```
           Locate the `- --authorization-mode=...` line under `spec.containers[].command`. If it does not exist, add it; if it exists, modify it so that it includes `RBAC`, for example:
           ```yaml theme={null}
           - --authorization-mode=Node,RBAC
           ```
           Save and exit. Editing this file will cause the kube-apiserver static pod to restart automatically.

        3. On every control plane node where you changed the file, confirm the kube-apiserver pod has restarted and is running:
           ```bash theme={null}
           sudo crictl ps | grep kube-apiserver || sudo docker ps | grep kube-apiserver
           ```

        4. On every control plane node, verify the kube-apiserver process now includes RBAC in the `--authorization-mode` argument:
           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--authorization-mode'
           ```
           Confirm the output shows `--authorization-mode` with a value that includes `RBAC` (for example, `--authorization-mode=Node,RBAC`).
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the kube-apiserver static pod manifest or its process flags. This finding must be remediated directly on each control plane node by editing `/etc/kubernetes/manifests/kube-apiserver.yaml`; see the Manual Steps section for exact instructions.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        # Purpose: Ensure kube-apiserver --authorization-mode includes RBAC on all control plane nodes
        # Scope:   Run on every control plane node (with root privileges)

        set -euo pipefail

        MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        TMP_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml.tmp"

        if [[ $EUID -ne 0 ]]; then
          echo "This script must be run as root (it edits ${MANIFEST})." >&2
          exit 1
        fi

        if [[ ! -f "${MANIFEST}" ]]; then
          echo "Manifest ${MANIFEST} not found; is this a control plane node using static pods?" >&2
          exit 1
        fi

        echo "Backing up ${MANIFEST} to ${MANIFEST}.$(date +%Y%m%d%H%M%S).bak"
        cp -p "${MANIFEST}" "${MANIFEST}.$(date +%Y%m%d%H%M%S).bak"

        # Idempotently ensure --authorization-mode includes RBAC
        # Handles three cases:
        #  1) No --authorization-mode present: add a new arg with 'Node,RBAC'
        #  2) Present but missing RBAC: append ",RBAC"
        #  3) Present and already includes RBAC: leave unchanged

        awk -v OFS="" '
          $0 ~ /--authorization-mode=/ {
            # Process only once
            if (processed == 1) { print; next }
            processed = 1

            line = $0
            # Extract the value after --authorization-mode=
            match(line, /--authorization-mode=([^"[:space:]]*)/, arr)
            if (arr[1] == "") {
              print
              next
            }

            mode = arr[1]
            # If RBAC already present (as a separate item), leave as-is
            split(mode, parts, ",")
            has_rbac = 0
            for (i in parts) {
              if (parts[i] == "RBAC") {
                has_rbac = 1
                break
              }
            }

            if (has_rbac == 1) {
              print
              next
            }

            # Append RBAC
            newmode = mode ",RBAC"
            sub(/--authorization-mode=[^"[:space:]]*/, "--authorization-mode=" newmode, line)
            print line
            next
          }
          { print }
          END {
            if (processed != 1) {
              # Need to add a new arg line under containers.args
              # This is a simple append; we do not attempt to be YAML-aware beyond this.
            }
          }
        ' "${MANIFEST}" > "${TMP_MANIFEST}"

        # If we did not find --authorization-mode at all, append a new arg under containers.args
        if ! grep -q -- "--authorization-mode=" "${TMP_MANIFEST}"; then
          echo "No --authorization-mode found; adding --authorization-mode=Node,RBAC under containers.args"

          awk -v OFS="" '
            /name: kube-apiserver/ { in_apiserver = 1 }
            in_apiserver && /args:/ && !in_args {
              in_args = 1
              print
              print "    - --authorization-mode=Node,RBAC"
              next
            }
            { print }
          ' "${TMP_MANIFEST}" > "${TMP_MANIFEST}.with_authmode" || {
            echo "Failed to inject --authorization-mode into manifest." >&2
            exit 1
          }
          mv "${TMP_MANIFEST}.with_authmode" "${TMP_MANIFEST}"
        fi

        # Replace original manifest (this will trigger a kube-apiserver restart via kubelet static pod management)
        mv "${TMP_MANIFEST}" "${MANIFEST}"

        echo "Updated ${MANIFEST}. kube-apiserver static pod will be restarted automatically."

        echo "Waiting for kube-apiserver process to restart with RBAC in authorization-mode..."
        sleep 20

        # Verification: ensure RBAC is present in the kube-apiserver --authorization-mode flag
        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--authorization-mode=.*RBAC"; then
          echo "Verification succeeded: kube-apiserver is running with --authorization-mode including RBAC."
          /bin/ps -ef | grep kube-apiserver | grep -v grep | sed -n "1p"
        else
          echo "Verification FAILED: kube-apiserver process does not show --authorization-mode including RBAC." >&2
          /bin/ps -ef | grep kube-apiserver | grep -v grep || true
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/reference/access-authn-authz/rbac/](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)