cis-gke-autopilot-v120-4-1-9

name	cis-gke-autopilot-v120-4.1.9
description	Avoid non-default bindings to system:unauthenticated (Automated)
category	cis-gke-autopilot
version	1.2.0
author	cyberstrike-official
tags	["cis","gke-autopilot","kubernetes","gcp","rbac","service-accounts","unauthenticated","cluster-role-bindings"]
cis_id	4.1.9
cis_benchmark	CIS Google Kubernetes Engine (GKE) Autopilot Benchmark v1.2.0
tech_stack	["kubernetes","gcp","gke"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

4.1.9 Avoid non-default bindings to system:unauthenticated (Automated)

Profile Applicability

• Level 1

Description

Avoid non-default ClusterRoleBindings and RoleBindings with the group system:unauthenticated, except the ClusterRoleBinding system:public-info-viewer.

Rationale

Kubernetes assigns the group system:unauthenticated to API server requests that have no authentication information provided. Binding a role to this group gives any unauthenticated user the permissions granted by that role and is strongly discouraged.

Impact

Unauthenticated users will have privileges and permissions associated with roles associated with the configured bindings.

Care should be taken before removing any non-default clusterrolebindings or rolebindings from the environment to ensure they were not required for operation of the cluster. Leverage a more specific and authenticated user for cluster operations.

Audit

Both ClusterRoleBindings and RoleBindings should be audited. Use the following command to confirm there are no non-default ClusterRoleBindings to group system:unauthenticated:

$ kubectl get clusterrolebindings -o json   | jq -r '["Name"], ["-----"], (.items[] | select((.subjects | length) > 0) | select(any(.subjects[]; .name == "system:unauthenticated")) | [.metadata.namespace, .metadata.name]) | @tsv'

Only the following default ClusterRoleBinding should be displayed:

Name
-----
        system:public-info-viewer

If any non-default bindings exist, review their permissions with the following command and reassess their privilege.

$ kubectl get clusterrolebinding [CLUSTER_ROLE_BINDING_NAME] -o json \
    | jq ' .roleRef.name +" " + .roleRef.kind' \
    | sed -e 's/"//g' \
    | xargs -l bash -c 'kubectl get $1 $0 -o yaml'

Confirm that there are no RoleBindings including the system:unauthenticated group:

$ kubectl get rolebindings -A -o json \
  | jq -r '["Namespace", "Name"], ["---------", "-----"], (.items[] | select((.subjects | length) > 0) | select(any(.subjects[]; .name == "system:unauthenticated")) | [.metadata.namespace, .metadata.name]) | @tsv'