Ensure Authorization Mode Argument Is Not AlwaysAllow

More Info:

Do not always authorize all requests.

Risk Level

High

Address

Security

Compliance Standards

• CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

1. On every control plane node, open the API server static pod manifest for editing:

   sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

2. In the command: section, locate any existing --authorization-mode argument. If it is set to AlwaysAllow (alone or in a list), change it so that AlwaysAllow is not present. For example, replace a line like:

   - --authorization-mode=AlwaysAllow

   or

   - --authorization-mode=AlwaysAllow,Node

   with:

   - --authorization-mode=RBAC

   (or a combination that does not include AlwaysAllow, such as Node,RBAC if required by your design).

3. If there is no --authorization-mode line, add one under the other - -- flags in the command: list:

   - --authorization-mode=RBAC

4. Save and exit the file. The kubelet will automatically detect the manifest change and restart the kube-apiserver static pod; expect a brief control-plane disruption while it restarts.

5. Wait for the API server pod to become Ready again (from any machine with kubectl access):

   kubectl get pods -n kube-system -l component=kube-apiserver -o wide

6. Verify on each control plane node that the API server no longer uses AlwaysAllow:

   /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- --authorization-mode

   Confirm the --authorization-mode value(s) shown do not contain AlwaysAllow (e.g., they show RBAC or Node,RBAC).

Using kubectl

kubectl cannot modify the kube-apiserver static pod manifest or its process flags. To remediate this finding, you must edit /etc/kubernetes/manifests/kube-apiserver.yaml directly on every control plane node; see the Manual Steps section for the required host-level changes.

Automation

#!/usr/bin/env bash
#
# Fix CISKubernetes 1.2.7: Ensure --authorization-mode is not AlwaysAllow
# Target: every control plane node
# Surface: /etc/kubernetes/manifests/kube-apiserver.yaml (static pod manifest)
#
# Usage: run as root on each control plane node
#   sudo bash fix_kube_apiserver_authz_mode.sh
#
# This script:
#   - Backs up the kube-apiserver manifest
#   - Ensures --authorization-mode includes RBAC and does not include AlwaysAllow
#   - Leaves any additional existing modes in place, except AlwaysAllow
#   - Relies on kubelet to restart the apiserver due to manifest change
#   - Verifies the resulting process flags

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-authorization-mode"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

require_root() {
  if [[ "$EUID" -ne 0 ]]; then
    echo "ERROR: This script must be run as root." >&2
    exit 1
  fi
}

backup_manifest() {
  if [[ ! -f "$MANIFEST" ]]; then
    echo "ERROR: kube-apiserver manifest not found at $MANIFEST" >&2
    exit 1
  fi

  mkdir -p "$BACKUP_DIR"
  local backup_file="${BACKUP_DIR}/kube-apiserver.yaml.${TIMESTAMP}"
  cp -p "$MANIFEST" "$backup_file"
  echo "Backup created: $backup_file"
}

update_authorization_mode() {
  # Strategy:
  # 1. Remove any existing --authorization-mode=... occurrences entirely.
  # 2. Append a single well-formed argument: --authorization-mode=RBAC
  #
  # This is strict but simple and compliant with the benchmark remediation.

  local tmpfile
  tmpfile="$(mktemp)"

  # Delete any line containing --authorization-mode=
  # (handles both "--authorization-mode=..." and "--authorization-mode ...")
  sed '/--authorization-mode[[:space:]=]/d' "$MANIFEST" > "$tmpfile"

  # Insert new authorization flag under the command section.
  # We try to place it near other flags for readability.
  if grep -q "kube-apiserver" "$tmpfile"; then
    # Attempt to insert after the kube-apiserver command line
    awk '
      /kube-apiserver/ && /command:/ {
        print $0
        next
      }
      /kube-apiserver/ && /- kube-apiserver/ {
        print $0
        print "    - --authorization-mode=RBAC"
        next
      }
      { print $0 }
    ' "$tmpfile" > "${tmpfile}.2"

    # If we didn’t succeed in adding the line (no new auth line), append it
    if ! grep -q -- "--authorization-mode=RBAC" "${tmpfile}.2"; then
      printf "\n    - --authorization-mode=RBAC\n" >> "${tmpfile}.2"
    fi
    mv "${tmpfile}.2" "$tmpfile"
  else
    # Fallback: append the flag near the end
    printf "\n    - --authorization-mode=RBAC\n" >> "$tmpfile"
  fi

  # Make the change atomic
  mv "$tmpfile" "$MANIFEST"
  echo "Updated $MANIFEST with --authorization-mode=RBAC (AlwaysAllow removed)."
}

wait_for_apiserver_restart() {
  echo "Waiting for kube-apiserver to restart with new arguments..."
  # Wait up to 120 seconds for a process with RBAC and without AlwaysAllow
  local timeout=120
  local interval=5
  local elapsed=0

  while (( elapsed < timeout )); do
    if /bin/ps -ef | grep kube-apiserver | grep -v grep >/dev/null 2>&1; then
      if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--authorization-mode"; then
        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "RBAC" && \
           ! /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "AlwaysAllow"; then
          echo "kube-apiserver is running with desired authorization-mode."
          return 0
        fi
      fi
    fi
    sleep "$interval"
    elapsed=$((elapsed + interval))
  done

  echo "WARNING: Timed out waiting for kube-apiserver to restart with the desired flags." >&2
  return 1
}

verify() {
  echo "Verification: current kube-apiserver process flags on this control plane node:"
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true

  echo
  echo "Checking that --authorization-mode is present, includes RBAC, and does NOT include AlwaysAllow..."
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--authorization-mode"; then
    if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "RBAC" && \
       ! /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "AlwaysAllow"; then
      echo "SUCCESS: kube-apiserver passes CISKubernetes 1.2.7 on this node."
      exit 0
    else
      echo "ERROR: kube-apiserver still has incorrect authorization-mode configuration." >&2
      exit 1
    fi
  else
    echo "ERROR: kube-apiserver is running without --authorization-mode flag." >&2
    exit 1
  fi
}

main() {
  require_root
  backup_manifest
  update_authorization_mode

  echo "NOTE: Editing a static pod manifest under /etc/kubernetes/manifests causes kubelet to restart the kube-apiserver pod automatically."
  wait_for_apiserver_restart || true
  verify
}

main "$@"

Additional Reading:

• https://kubernetes.io/docs/admin/kube-apiserver/