> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Authorization Mode Argument Is Not AlwaysAllow ### More Info: Do not always authorize all requests. ### Risk Level High ### Address Security ### Compliance Standards * CIS Kubernetes ### Triage and Remediation ### Remediation 1. On every control plane node, open the API server static pod manifest for editing: ```bash theme={null} sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml ``` 2. In the `command:` section, locate any existing `--authorization-mode` argument. If it is set to `AlwaysAllow` (alone or in a list), change it so that `AlwaysAllow` is not present. For example, replace a line like: ```yaml theme={null} - --authorization-mode=AlwaysAllow ``` or ```yaml theme={null} - --authorization-mode=AlwaysAllow,Node ``` with: ```yaml theme={null} - --authorization-mode=RBAC ``` (or a combination that does not include `AlwaysAllow`, such as `Node,RBAC` if required by your design). 3. If there is no `--authorization-mode` line, add one under the other `- --` flags in the `command:` list: ```yaml theme={null} - --authorization-mode=RBAC ``` 4. Save and exit the file. The kubelet will automatically detect the manifest change and restart the `kube-apiserver` static pod; expect a brief control-plane disruption while it restarts. 5. Wait for the API server pod to become Ready again (from any machine with kubectl access): ```bash theme={null} kubectl get pods -n kube-system -l component=kube-apiserver -o wide ``` 6. Verify on each control plane node that the API server no longer uses `AlwaysAllow`: ```bash theme={null} /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- --authorization-mode ``` Confirm the `--authorization-mode` value(s) shown do not contain `AlwaysAllow` (e.g., they show `RBAC` or `Node,RBAC`). kubectl cannot modify the kube-apiserver static pod manifest or its process flags. To remediate this finding, you must edit `/etc/kubernetes/manifests/kube-apiserver.yaml` directly on every control plane node; see the Manual Steps section for the required host-level changes. ```bash theme={null} #!/usr/bin/env bash # # Fix CISKubernetes 1.2.7: Ensure --authorization-mode is not AlwaysAllow # Target: every control plane node # Surface: /etc/kubernetes/manifests/kube-apiserver.yaml (static pod manifest) # # Usage: run as root on each control plane node # sudo bash fix_kube_apiserver_authz_mode.sh # # This script: # - Backs up the kube-apiserver manifest # - Ensures --authorization-mode includes RBAC and does not include AlwaysAllow # - Leaves any additional existing modes in place, except AlwaysAllow # - Relies on kubelet to restart the apiserver due to manifest change # - Verifies the resulting process flags set -euo pipefail MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml" BACKUP_DIR="/etc/kubernetes/manifests/backup-authorization-mode" TIMESTAMP="$(date +%Y%m%d-%H%M%S)" require_root() { if [[ "$EUID" -ne 0 ]]; then echo "ERROR: This script must be run as root." >&2 exit 1 fi } backup_manifest() { if [[ ! -f "$MANIFEST" ]]; then echo "ERROR: kube-apiserver manifest not found at $MANIFEST" >&2 exit 1 fi mkdir -p "$BACKUP_DIR" local backup_file="${BACKUP_DIR}/kube-apiserver.yaml.${TIMESTAMP}" cp -p "$MANIFEST" "$backup_file" echo "Backup created: $backup_file" } update_authorization_mode() { # Strategy: # 1. Remove any existing --authorization-mode=... occurrences entirely. # 2. Append a single well-formed argument: --authorization-mode=RBAC # # This is strict but simple and compliant with the benchmark remediation. local tmpfile tmpfile="$(mktemp)" # Delete any line containing --authorization-mode= # (handles both "--authorization-mode=..." and "--authorization-mode ...") sed '/--authorization-mode[[:space:]=]/d' "$MANIFEST" > "$tmpfile" # Insert new authorization flag under the command section. # We try to place it near other flags for readability. if grep -q "kube-apiserver" "$tmpfile"; then # Attempt to insert after the kube-apiserver command line awk ' /kube-apiserver/ && /command:/ { print $0 next } /kube-apiserver/ && /- kube-apiserver/ { print $0 print " - --authorization-mode=RBAC" next } { print $0 } ' "$tmpfile" > "${tmpfile}.2" # If we didn’t succeed in adding the line (no new auth line), append it if ! grep -q -- "--authorization-mode=RBAC" "${tmpfile}.2"; then printf "\n - --authorization-mode=RBAC\n" >> "${tmpfile}.2" fi mv "${tmpfile}.2" "$tmpfile" else # Fallback: append the flag near the end printf "\n - --authorization-mode=RBAC\n" >> "$tmpfile" fi # Make the change atomic mv "$tmpfile" "$MANIFEST" echo "Updated $MANIFEST with --authorization-mode=RBAC (AlwaysAllow removed)." } wait_for_apiserver_restart() { echo "Waiting for kube-apiserver to restart with new arguments..." # Wait up to 120 seconds for a process with RBAC and without AlwaysAllow local timeout=120 local interval=5 local elapsed=0 while (( elapsed < timeout )); do if /bin/ps -ef | grep kube-apiserver | grep -v grep >/dev/null 2>&1; then if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--authorization-mode"; then if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "RBAC" && \ ! /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "AlwaysAllow"; then echo "kube-apiserver is running with desired authorization-mode." return 0 fi fi fi sleep "$interval" elapsed=$((elapsed + interval)) done echo "WARNING: Timed out waiting for kube-apiserver to restart with the desired flags." >&2 return 1 } verify() { echo "Verification: current kube-apiserver process flags on this control plane node:" /bin/ps -ef | grep kube-apiserver | grep -v grep || true echo echo "Checking that --authorization-mode is present, includes RBAC, and does NOT include AlwaysAllow..." if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--authorization-mode"; then if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "RBAC" && \ ! /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "AlwaysAllow"; then echo "SUCCESS: kube-apiserver passes CISKubernetes 1.2.7 on this node." exit 0 else echo "ERROR: kube-apiserver still has incorrect authorization-mode configuration." >&2 exit 1 fi else echo "ERROR: kube-apiserver is running without --authorization-mode flag." >&2 exit 1 fi } main() { require_root backup_manifest update_authorization_mode echo "NOTE: Editing a static pod manifest under /etc/kubernetes/manifests causes kubelet to restart the kube-apiserver pod automatically." wait_for_apiserver_restart || true verify } main "$@" ``` ### Additional Reading: * [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)