Skip to main content

Ensure Token Auth File Parameter Is Not Set

More Info:​

Do not use token based authentication.

Risk Level​

High

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, back up the API server manifest before editing:

    sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak.$(date +%F-%H%M%S)

  2. On every control plane node, inspect the current manifest for any --token-auth-file usage:

    sudo grep -n -- '--token-auth-file' /etc/kubernetes/manifests/kube-apiserver.yaml || echo "No token-auth-file flag found"

  3. On every control plane node, edit the manifest to remove the --token-auth-file=<filename> flag from the kube-apiserver container command or args list:

    sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

    In the editor, delete the entire line containing --token-auth-file= (or remove just that entry from the list), then save and exit.
    Note: Saving this file will trigger the kubelet to restart the API server static pod.

  4. Wait for the API server pod to restart and become Running on the local node:

    sudo crictl ps | grep kube-apiserver

    Ensure there is a recent kube-apiserver container in Running state.

  5. On every control plane node, verify the kube-apiserver process no longer has the --token-auth-file flag:

    /bin/ps -ef | grep kube-apiserver | grep -v grep

    Confirm that the command line for the kube-apiserver process does not contain --token-auth-file=.

Using kubectl

kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so it cannot be used to remove the --token-auth-file parameter. To address this finding, make the change directly on each control plane node in /etc/kubernetes/manifests/kube-apiserver.yaml as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Automation: Remove --token-auth-file from kube-apiserver manifest
#
# Usage:
#   1) Copy this script to every control plane node (or run via SSH/Ansible).
#   2) Run as root:  sudo bash ./fix_kube_apiserver_token_auth.sh
#   3) Safe to re-run; it is idempotent.
#
# Operational impact:
#   - Editing /etc/kubernetes/manifests/kube-apiserver.yaml will cause
#     the kubelet to restart the kube-apiserver static pod on this node.

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-token-auth-file-fix"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

echo "=== [$(hostname)] Ensuring --token-auth-file is not set for kube-apiserver ==="

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

if [[ ! -f "$MANIFEST" ]]; then
  echo "ERROR: Manifest not found at $MANIFEST. Nothing changed." >&2
  exit 1
fi

mkdir -p "$BACKUP_DIR"

# Backup once per timestamp; keep original name for clarity
BACKUP_FILE="$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"
cp -p "$MANIFEST" "$BACKUP_FILE"
echo "Backup created: $BACKUP_FILE"

# Check if --token-auth-file is present
if ! grep -q -- '--token-auth-file' "$MANIFEST"; then
  echo "No --token-auth-file parameter found in $MANIFEST; no changes needed."
else
  echo "Removing --token-auth-file from $MANIFEST ..."

  # Remove argument lines or inline arguments containing --token-auth-file
  # Handles both list-form args:
  #   - --token-auth-file=/path
  # and combined lines:
  #   - --foo=bar --token-auth-file=/path --baz=qux
  #
  # Strategy:
  #   1) Delete any YAML list items that *only* contain --token-auth-file.
  #   2) For lines with multiple args, strip just the token-auth-file portion.

  # Step 1: Drop lines that are dedicated token-auth-file args
  # e.g. "    - --token-auth-file=/etc/kubernetes/tokens"
  sed -i '/--token-auth-file[= ]/d' "$MANIFEST"

  # Step 2: Clean up any residual inline occurrences (defensive)
  # Replace " --token-auth-file=VALUE" with empty string (space-prefixed)
  sed -i 's/ --token-auth-file[^ ]*//g' "$MANIFEST"
  # Also handle start-of-line case in args list
  sed -i 's/^- *--token-auth-file[^ ]* *//g' "$MANIFEST"

  echo "Updated $MANIFEST to remove --token-auth-file."
  echo "kube-apiserver static pod will be restarted automatically by kubelet."
fi

# Verification: ensure kube-apiserver is running without --token-auth-file
echo "Waiting briefly for kube-apiserver to stabilize..."
sleep 10

echo "=== Verification: checking running kube-apiserver process for --token-auth-file ==="
/bin/ps -ef | grep kube-apiserver | grep -v grep || {
  echo "WARNING: kube-apiserver process not found. It may still be starting or there is an issue." >&2
}

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--token-auth-file'; then
  echo "FAIL: kube-apiserver is still running with --token-auth-file set." >&2
  echo "Inspect $MANIFEST and kubelet logs for issues." >&2
  exit 1
else
  echo "PASS: kube-apiserver is running without --token-auth-file."
fi

Additional Reading:​