> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# API Server Should Enable The NodeRestriction Admission Plugin

### More Info:

Verifies that the NodeRestriction admission plugin is enabled so kubelets can only modify their own node and pod objects, limiting a compromised nodes reach.

### Risk Level

High

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, back up the API server static pod manifest:

        ```bash theme={null}
        sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml \
        /etc/kubernetes/manifests/kube-apiserver.yaml.backup.$(date +%F-%H%M%S)
        ```

        2. On every control plane node, open the manifest for editing:

        ```bash theme={null}
        sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
        ```

        3. In the container command section, locate the `--enable-admission-plugins` argument.
           * If it exists, ensure `NodeRestriction` is listed (comma‑separated), for example:

        ```yaml theme={null}
            - --enable-admission-plugins=NamespaceLifecycle,ServiceAccount,NodeRestriction,ResourceQuota
        ```

        * If it does not exist, add a new line in the command list, e.g.:

        ```yaml theme={null}
            - --enable-admission-plugins=NodeRestriction
        ```

        4. Save the file and exit the editor. The kubelet will automatically restart the `kube-apiserver` static pod because the manifest under `/etc/kubernetes/manifests` changed, which will briefly restart the API server on that node.

        5. Wait for the API server pod to come back to Running on the control plane node (you can monitor with):

        ```bash theme={null}
        sudo crictl ps | grep kube-apiserver
        ```

        6. Verify on every control plane node that the `kube-apiserver` process includes `NodeRestriction` in `--enable-admission-plugins`:

        ```bash theme={null}
        /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--enable-admission-plugins' | grep NodeRestriction
        ```
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot configure API server admission plugins or edit the static pod manifest at `/etc/kubernetes/manifests/kube-apiserver.yaml` on control plane nodes. To enable the `NodeRestriction` admission plugin and remediate this finding, follow the guidance in the Manual Steps section on each control plane node.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automation: Ensure kube-apiserver enables the NodeRestriction admission plugin
        # Target: every control plane node
        # Effect: Editing /etc/kubernetes/manifests/kube-apiserver.yaml will restart kube-apiserver (static pod)

        set -euo pipefail

        APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-$(date -u +%Y%m%dT%H%M%SZ)"

        echo "[*] Checking for kube-apiserver manifest at ${APISERVER_MANIFEST}"
        if [[ ! -f "${APISERVER_MANIFEST}" ]]; then
          echo "ERROR: ${APISERVER_MANIFEST} not found on this node. Is this a control plane node?"
          exit 1
        fi

        mkdir -p "${BACKUP_DIR}"

        echo "[*] Backing up current manifest to ${BACKUP_DIR}"
        cp -p "${APISERVER_MANIFEST}" "${BACKUP_DIR}/kube-apiserver.yaml"

        echo "[*] Ensuring --enable-admission-plugins includes NodeRestriction"

        # Case 1: --enable-admission-plugins already present
        if grep -q -- '--enable-admission-plugins=' "${APISERVER_MANIFEST}"; then
          # If NodeRestriction is already in the list, no change needed
          if grep -q -- '--enable-admission-plugins=.*NodeRestriction' "${APISERVER_MANIFEST}"; then
            echo "[*] NodeRestriction already enabled in --enable-admission-plugins; no manifest change required."
          else
            echo "[*] Adding NodeRestriction to existing --enable-admission-plugins list"
            # Append NodeRestriction to the list, preserving existing plugins
            # This assumes standard YAML args list where the flag is in one line
            tmpfile="$(mktemp)"
            sed -E 's/(--enable-admission-plugins=)([^"]*)/\1\2,NodeRestriction/' \
              "${APISERVER_MANIFEST}" > "${tmpfile}"
            mv "${tmpfile}" "${APISERVER_MANIFEST}"
            echo "[*] Updated --enable-admission-plugins to include NodeRestriction"
          fi
        else
          echo "[*] --enable-admission-plugins not present; adding with NodeRestriction"
          # Insert a new args line under the kube-apiserver container spec
          # This will be idempotent because we guard on flag absence above.
          tmpfile="$(mktemp)"
          awk '
            /- name: kube-apiserver/ { in_container=1 }
            in_container && /args:/ && !added {
              print $0
              print "    - --enable-admission-plugins=NodeRestriction"
              added=1
              next
            }
            { print $0 }
          ' "${APISERVER_MANIFEST}" > "${tmpfile}"

          mv "${tmpfile}" "${APISERVER_MANIFEST}"
          echo "[*] Added --enable-admission-plugins=NodeRestriction to kube-apiserver args"
        fi

        echo "[*] Waiting for kube-apiserver static pod to restart (this may take up to a minute)..."
        sleep 30

        echo "[*] Verifying that kube-apiserver process has NodeRestriction enabled"
        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--enable-admission-plugins=.*NodeRestriction'; then
          echo "[OK] kube-apiserver is running with --enable-admission-plugins including NodeRestriction"
          exit 0
        fi

        echo "[WARN] kube-apiserver process does not yet show NodeRestriction in --enable-admission-plugins."
        echo "       Re-check with:"
        echo "         /bin/ps -ef | grep kube-apiserver | grep -v grep"
        exit 1
        ```

        **Usage**

        Run this script on every control plane node as a user with permission to modify `/etc/kubernetes/manifests/kube-apiserver.yaml`:

        ```bash theme={null}
        sudo bash ./enable_noderestriction.sh
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>