> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # API Server Token Auth File Should Not Be Set ### More Info: Verifies that the API server --token-auth-file parameter is not set. Static token files are long-lived, unrotatable credentials that should be replaced with stronger authentication. ### Risk Level High ### Address Security ### Compliance Standards * CIS Kubernetes ### Triage and Remediation ### Remediation 1. On every control plane node, back up the API server static pod manifest: ```bash theme={null} sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak ``` 2. On every control plane node, open the manifest for editing: ```bash theme={null} sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml ``` 3. In the `command` (or `args`) list for `kube-apiserver`, locate and delete the entire `--token-auth-file=...` entry, ensuring it is removed as a separate list item, for example delete a line like: ```yaml theme={null} - --token-auth-file=/etc/kubernetes/pki/tokens.csv ``` Save and exit the editor. Editing a file under `/etc/kubernetes/manifests` will cause the kubelet to restart the `kube-apiserver` static pod automatically. 4. On every control plane node, wait for the API server pod to be recreated and running (this may take up to a minute): ```bash theme={null} sudo crictl ps | grep kube-apiserver ``` Confirm that a `kube-apiserver` container is listed and not in a restarting loop. 5. On any machine with `kubectl` access, verify that cluster access still works using your supported authentication mechanism (for example, client certificates or an external auth provider): ```bash theme={null} kubectl get nodes ``` 6. On every control plane node, verify the `--token-auth-file` flag is no longer present in the running process: ```bash theme={null} /bin/ps -ef | grep kube-apiserver | grep -v grep ``` Inspect the output and confirm there is no `--token-auth-file=` argument shown for the `kube-apiserver` process. kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so this finding cannot be fixed via the Kubernetes API. To remediate, you must edit `/etc/kubernetes/manifests/kube-apiserver.yaml` directly on every control plane node; see the Manual Steps section for the exact host-level procedure. ```bash theme={null} #!/usr/bin/env bash # # Automation: Remove --token-auth-file from kube-apiserver static pod manifest # Scope: Run on every control plane node # Requirements: bash, sed, grep, systemctl (if kubelet is systemd-managed) # Idempotent: safe to re-run set -euo pipefail MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml" BACKUP_DIR="/etc/kubernetes/manifests/backup-token-auth-file-removal" TIMESTAMP="$(date +%Y%m%d-%H%M%S)" echo "=== [1/4] Validating environment on this control plane node ===" if [ ! -f "$MANIFEST" ]; then echo "ERROR: Manifest not found at $MANIFEST. Is this a static pod control plane node?" exit 1 fi mkdir -p "$BACKUP_DIR" echo "=== [2/4] Backing up current manifest (once) ===" # Create a timestamped backup every run, keep an initial 'pre-change' backup if not present if [ ! -f "$BACKUP_DIR/kube-apiserver.yaml.prechange" ]; then cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.prechange" echo "Saved initial backup to $BACKUP_DIR/kube-apiserver.yaml.prechange" fi cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP" echo "Saved backup to $BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP" echo "=== [3/4] Editing manifest to remove --token-auth-file flag (idempotent) ===" # If no token-auth-file is present, nothing to change if ! grep -q -- '--token-auth-file' "$MANIFEST"; then echo "No --token-auth-file flag present; no changes needed." else # Use a temporary file for safe in-place edit TMP="$(mktemp)" # Remove any arguments containing --token-auth-file (handles --token-auth-file=FILE and split forms) # This: # - deletes whole lines containing ' --token-auth-file' if used on its own line # - removes ' --token-auth-file=...' tokens within a line, normalizing whitespace awk ' { line=$0 # Remove occurrences like "--token-auth-file=/path" or "--token-auth-file /path" gsub(/--token-auth-file(=[^[:space:]]+)?/, "", line) # Remove any extra spaces introduced sub(/^[[:space:]]+/, "", line) gsub(/[[:space:]]+/, " ", line) # If the line becomes just a dash for YAML list item with nothing else, keep it as "-" if (line ~ /^-$/) { print line } else if (line ~ /^[[:space:]]*$/) { print "" } else { print line } }' "$MANIFEST" > "$TMP" mv "$TMP" "$MANIFEST" chmod 600 "$MANIFEST" echo "Removed --token-auth-file flag from $MANIFEST." echo "Kubelet will detect the manifest change and restart the kube-apiserver pod." fi echo "=== [4/4] Verification: kube-apiserver process flags ===" # Wait briefly for kubelet to restart the static pod if a change occurred sleep 10 # Show running kube-apiserver command line and verify absence of --token-auth-file if ! /bin/ps -ef | grep kube-apiserver | grep -v grep >/dev/null 2>&1; then echo "WARNING: kube-apiserver process not currently visible in ps output." echo "The manifest no longer contains --token-auth-file, but ensure kube-apiserver is healthy." else echo "--- kube-apiserver command line (filtered) ---" /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^/ /' echo "---------------------------------------------" if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--token-auth-file'; then echo "ERROR: kube-apiserver still running with --token-auth-file flag." echo "Investigate other configuration sources (e.g. non-static-pod deployments)." exit 2 else echo "SUCCESS: kube-apiserver is running without --token-auth-file." fi fi ```