Detections
Analytics

1.2.10 Ensure that the admission control plugin AlwaysAdmit is not set

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Do not allow all requests.

Setting admission control plugin AlwaysAdmit allows all requests and do not filter any requests.

The AlwaysAdmit admission controller was deprecated in Kubernetes v1.13. Its behavior was equivalent to turning off all admission controllers.

Solution

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and either remove the --enable-admission-plugins parameter, or set it to a value that does not include AlwaysAdmit.

Impact:

Only requests explicitly allowed by the admissions control plugins would be served.

See Also

https://workbench.cisecurity.org/benchmarks/26831

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 3ef355e55f9b5b7984cfbf52890a39a2cdd528624705e3ed9828cd3b6600f9db