> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Token Auth File Parameter Is Not Set

### More Info:

Do not use token based authentication.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, back up the API server manifest before editing:
           ```bash theme={null}
           sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak.$(date +%F-%H%M%S)
           ```

        2. On every control plane node, inspect the current manifest for any `--token-auth-file` usage:
           ```bash theme={null}
           sudo grep -n -- '--token-auth-file' /etc/kubernetes/manifests/kube-apiserver.yaml || echo "No token-auth-file flag found"
           ```

        3. On every control plane node, edit the manifest to remove the `--token-auth-file=<filename>` flag from the `kube-apiserver` container `command` or `args` list:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```
           In the editor, delete the entire line containing `--token-auth-file=` (or remove just that entry from the list), then save and exit.\
           Note: Saving this file will trigger the kubelet to restart the API server static pod.

        4. Wait for the API server pod to restart and become Running on the local node:
           ```bash theme={null}
           sudo crictl ps | grep kube-apiserver
           ```
           Ensure there is a recent kube-apiserver container in `Running` state.

        5. On every control plane node, verify the kube-apiserver process no longer has the `--token-auth-file` flag:
           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep
           ```
           Confirm that the command line for the kube-apiserver process does not contain `--token-auth-file=`.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so it cannot be used to remove the `--token-auth-file` parameter. To address this finding, make the change directly on each control plane node in `/etc/kubernetes/manifests/kube-apiserver.yaml` as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automation: Remove --token-auth-file from kube-apiserver manifest
        #
        # Usage:
        #   1) Copy this script to every control plane node (or run via SSH/Ansible).
        #   2) Run as root:  sudo bash ./fix_kube_apiserver_token_auth.sh
        #   3) Safe to re-run; it is idempotent.
        #
        # Operational impact:
        #   - Editing /etc/kubernetes/manifests/kube-apiserver.yaml will cause
        #     the kubelet to restart the kube-apiserver static pod on this node.

        set -euo pipefail

        MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-token-auth-file-fix"
        TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

        echo "=== [$(hostname)] Ensuring --token-auth-file is not set for kube-apiserver ==="

        if [[ $EUID -ne 0 ]]; then
          echo "ERROR: This script must be run as root." >&2
          exit 1
        fi

        if [[ ! -f "$MANIFEST" ]]; then
          echo "ERROR: Manifest not found at $MANIFEST. Nothing changed." >&2
          exit 1
        fi

        mkdir -p "$BACKUP_DIR"

        # Backup once per timestamp; keep original name for clarity
        BACKUP_FILE="$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"
        cp -p "$MANIFEST" "$BACKUP_FILE"
        echo "Backup created: $BACKUP_FILE"

        # Check if --token-auth-file is present
        if ! grep -q -- '--token-auth-file' "$MANIFEST"; then
          echo "No --token-auth-file parameter found in $MANIFEST; no changes needed."
        else
          echo "Removing --token-auth-file from $MANIFEST ..."

          # Remove argument lines or inline arguments containing --token-auth-file
          # Handles both list-form args:
          #   - --token-auth-file=/path
          # and combined lines:
          #   - --foo=bar --token-auth-file=/path --baz=qux
          #
          # Strategy:
          #   1) Delete any YAML list items that *only* contain --token-auth-file.
          #   2) For lines with multiple args, strip just the token-auth-file portion.

          # Step 1: Drop lines that are dedicated token-auth-file args
          # e.g. "    - --token-auth-file=/etc/kubernetes/tokens"
          sed -i '/--token-auth-file[= ]/d' "$MANIFEST"

          # Step 2: Clean up any residual inline occurrences (defensive)
          # Replace " --token-auth-file=VALUE" with empty string (space-prefixed)
          sed -i 's/ --token-auth-file[^ ]*//g' "$MANIFEST"
          # Also handle start-of-line case in args list
          sed -i 's/^- *--token-auth-file[^ ]* *//g' "$MANIFEST"

          echo "Updated $MANIFEST to remove --token-auth-file."
          echo "kube-apiserver static pod will be restarted automatically by kubelet."
        fi

        # Verification: ensure kube-apiserver is running without --token-auth-file
        echo "Waiting briefly for kube-apiserver to stabilize..."
        sleep 10

        echo "=== Verification: checking running kube-apiserver process for --token-auth-file ==="
        /bin/ps -ef | grep kube-apiserver | grep -v grep || {
          echo "WARNING: kube-apiserver process not found. It may still be starting or there is an issue." >&2
        }

        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--token-auth-file'; then
          echo "FAIL: kube-apiserver is still running with --token-auth-file set." >&2
          echo "Inspect $MANIFEST and kubelet logs for issues." >&2
          exit 1
        else
          echo "PASS: kube-apiserver is running without --token-auth-file."
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/authentication/#static-token-file](https://kubernetes.io/docs/admin/authentication/#static-token-file)