Detections
Analytics

1.2.9 Ensure that the --authorization-mode argument includes RBAC

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Turn on Role Based Access Control.

Rationale:

Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.

Impact:

When RBAC is enabled you will need to ensure that appropriate RBAC settings (including Roles, RoleBindings and ClusterRoleBindings) are configured to allow appropriate access.

Solution

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --authorization-mode parameter to a value that includes RBAC, for example:

--authorization-mode=Node,RBAC

Default Value:

By default, RBAC authorization is not enabled.

See Also

https://workbench.cisecurity.org/files/2968

Item Details

References: CSCv6|9.1, CSCv7|9.2

Plugin: Unix

Control ID: ad6b4059e2586240df3b775c9efb0332c46d06a9cc8ace57f74f0e86b2f84a48