API Server Token Auth File Should Not Be Set

More Info:

Verifies that the API server --token-auth-file parameter is not set. Static token files are long-lived, unrotatable credentials that should be replaced with stronger authentication.

Risk Level

High

Address

Security

Compliance Standards

CIS Kubernetes

Triage and Remediation

Remediation

Remediation

Manual Steps

On every control plane node, back up the API server static pod manifest:

sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak

On every control plane node, open the manifest for editing:
```
sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
```
In the command (or args) list for kube-apiserver, locate and delete the entire --token-auth-file=... entry, ensuring it is removed as a separate list item, for example delete a line like:
```
- --token-auth-file=/etc/kubernetes/pki/tokens.csv
```
Save and exit the editor. Editing a file under /etc/kubernetes/manifests will cause the kubelet to restart the kube-apiserver static pod automatically.
On every control plane node, wait for the API server pod to be recreated and running (this may take up to a minute):
```
sudo crictl ps | grep kube-apiserver
```
Confirm that a kube-apiserver container is listed and not in a restarting loop.
On any machine with kubectl access, verify that cluster access still works using your supported authentication mechanism (for example, client certificates or an external auth provider):
```
kubectl get nodes
```
On every control plane node, verify the --token-auth-file flag is no longer present in the running process:
```
/bin/ps -ef | grep kube-apiserver | grep -v grep
```
Inspect the output and confirm there is no --token-auth-file= argument shown for the kube-apiserver process.

Using kubectl

kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so this finding cannot be fixed via the Kubernetes API. To remediate, you must edit /etc/kubernetes/manifests/kube-apiserver.yaml directly on every control plane node; see the Manual Steps section for the exact host-level procedure.

Automation

#!/usr/bin/env bash
#
# Automation: Remove --token-auth-file from kube-apiserver static pod manifest
# Scope: Run on every control plane node
# Requirements: bash, sed, grep, systemctl (if kubelet is systemd-managed)
# Idempotent: safe to re-run

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-token-auth-file-removal"
TIMESTAMP="$(date +%Y%m%d-%H%M%S)"

echo "=== [1/4] Validating environment on this control plane node ==="

if [ ! -f "$MANIFEST" ]; then
  echo "ERROR: Manifest not found at $MANIFEST. Is this a static pod control plane node?"
  exit 1
fi

mkdir -p "$BACKUP_DIR"

echo "=== [2/4] Backing up current manifest (once) ==="
# Create a timestamped backup every run, keep an initial 'pre-change' backup if not present
if [ ! -f "$BACKUP_DIR/kube-apiserver.yaml.prechange" ]; then
  cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.prechange"
  echo "Saved initial backup to $BACKUP_DIR/kube-apiserver.yaml.prechange"
fi
cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"
echo "Saved backup to $BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

echo "=== [3/4] Editing manifest to remove --token-auth-file flag (idempotent) ==="

# If no token-auth-file is present, nothing to change
if ! grep -q -- '--token-auth-file' "$MANIFEST"; then
  echo "No --token-auth-file flag present; no changes needed."
else
  # Use a temporary file for safe in-place edit
  TMP="$(mktemp)"
  # Remove any arguments containing --token-auth-file (handles --token-auth-file=FILE and split forms)
  # This:
  #  - deletes whole lines containing ' --token-auth-file' if used on its own line
  #  - removes ' --token-auth-file=...' tokens within a line, normalizing whitespace
  awk '
  {
    line=$0
    # Remove occurrences like "--token-auth-file=/path" or "--token-auth-file /path"
    gsub(/--token-auth-file(=[^[:space:]]+)?/, "", line)
    # Remove any extra spaces introduced
    sub(/^[[:space:]]+/, "", line)
    gsub(/[[:space:]]+/, " ", line)
    # If the line becomes just a dash for YAML list item with nothing else, keep it as "-"
    if (line ~ /^-$/) { print line }
    else if (line ~ /^[[:space:]]*$/) { print "" }
    else { print line }
  }' "$MANIFEST" > "$TMP"

  mv "$TMP" "$MANIFEST"
  chmod 600 "$MANIFEST"
  echo "Removed --token-auth-file flag from $MANIFEST."
  echo "Kubelet will detect the manifest change and restart the kube-apiserver pod."
fi

echo "=== [4/4] Verification: kube-apiserver process flags ==="

# Wait briefly for kubelet to restart the static pod if a change occurred
sleep 10

# Show running kube-apiserver command line and verify absence of --token-auth-file
if ! /bin/ps -ef | grep kube-apiserver | grep -v grep >/dev/null 2>&1; then
  echo "WARNING: kube-apiserver process not currently visible in ps output."
  echo "The manifest no longer contains --token-auth-file, but ensure kube-apiserver is healthy."
else
  echo "--- kube-apiserver command line (filtered) ---"
  /bin/ps -ef | grep kube-apiserver | grep -v grep | sed 's/^/  /'
  echo "---------------------------------------------"
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--token-auth-file'; then
    echo "ERROR: kube-apiserver still running with --token-auth-file flag."
    echo "Investigate other configuration sources (e.g. non-static-pod deployments)."
    exit 2
  else
    echo "SUCCESS: kube-apiserver is running without --token-auth-file."
  fi
fi

More Info:​

Risk Level​

Address​

Compliance Standards​

Triage and Remediation​

Remediation​