Detections
Analytics

1.2.9 Ensure that the --authorization-mode argument includes RBAC

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Turn on Role Based Access Control.

Rationale:

Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.

Solution

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes RBAC, for example:

--authorization-mode=Node,RBAC

Impact:

When RBAC is enabled you will need to ensure that appropriate RBAC settings (including Roles, RoleBindings and ClusterRoleBindings) are configured to allow appropriate access.

Default Value:

By default, RBAC authorization is not enabled.

References:

https://kubernetes.io/docs/reference/access-authn-authz/rbac/

See Also

https://workbench.cisecurity.org/files/2662

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6, CSCv6|9.1, CSCv7|9.2

Plugin: Unix

Control ID: 23e70632e00739b2a19315dd1876c8d46c6f792d5cafe29ab68172d6c9d685be