| name | cis-eks-v170-3.2.2 |
| description | Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated) |
| category | cis-eks |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","eks","kubernetes","aws","worker-node","kubelet","authorization","webhook"] |
| cis_id | 3.2.2 |
| cis_benchmark | CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.7.0 |
| tech_stack | ["kubernetes","aws","eks"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
3.2.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)
Profile Applicability
Description
Do not allow all requests. Enable explicit authorization.
Rationale
Kubelets can be configured to allow all authenticated requests (even anonymous ones) without needing explicit authorization checks from the apiserver. You should restrict this behavior and only allow explicitly authorized requests.
Unauthorized requests will be denied.
Audit Procedure
Audit Method 1:
Kubelets can accept configuration via a configuration file and in some cases via command line arguments. It is important to note that parameters provided as command line arguments will override their counterpart parameters in the configuration file (see --config details in the Kubelet CLI Reference for more info).
With this in mind, it is important to check for the existence of command line arguments as well as configuration file entries when auditing Kubelet configuration.
Firstly, SSH to each node and execute the following command to find the Kubelet process:
ps -ef | grep kubelet
The output of the above command provides details of the active Kubelet process, from which we can see the command line arguments provided to the process. Also note the location of the configuration file, provided with the --config argument, as this will be needed to verify configuration. The file can be viewed with a command such as more or less, like so:
sudo less /path/to/kubelet-config.json
Verify that Webhook Authentication is enabled. This may be enabled as a command line argument to the kubelet service with --authentication-token-webhook or in the kubelet configuration file via "authentication": { "webhook": { "enabled": true } }.
Verify that the Authorization Mode is set to WebHook. This may be set as a command line argument to the kubelet service with --authorization-mode=Webhook or in the configuration file via "authorization": { "mode": "Webhook" }.
Audit Method 2:
It is also possible to review the running configuration of a Kubelet via the /configz endpoint of the Kubernetes API. This can be achieved using kubectl to proxy your requests to the API.
Discover all nodes in your cluster by running the following command:
