Detections
Analytics

1.2.1 Ensure that anonymous requests to the API server are restricted

Information

Disable anonymous requests to the API server entirely, or restrict anonymous authentication to only the specific endpoints that require it using the structured authentication configuration.

When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests, mapped to the system:anonymous user in the system:unauthenticated group. These requests are then served by the API server subject to authorization checks. Any misconfiguration that grants permissions to system:anonymous or system:unauthenticated (such as a ClusterRoleBinding to cluster-admin ) immediately exposes the affected API surface to unauthenticated attackers.

If your cluster does not require anonymous access to any endpoint, set --anonymous-auth=false to disable it entirely.

However, many clusters require anonymous access to specific endpoints such as the health check paths ( /healthz, /livez, /readyz ) used by load balancers. For these clusters, use of the configurable anonymous authentication endpoints via the AuthenticationConfiguration file provides an option for limited anonymous paths. Operators can restrict anonymous authentication to an explicit allowlist of URL paths, so that even if a dangerous ClusterRoleBinding exists for system:anonymous, it has no effect on endpoints outside the allowlist.

Solution

Option 1 - Structured authentication configuration

Add an anonymous section to the AuthenticationConfiguration file to restrict anonymous access to only required endpoints:

apiVersion: apiserver.config.k8s.io/v1beta1
kind: AuthenticationConfiguration
anonymous:
 enabled: true
 conditions:
 - path: /healthz
 - path: /livez
 - path: /readyz

Start the API server with --authentication-config pointing to this file. Remove the --anonymous-auth flag if present.

Option 2 - Disable anonymous authentication entirely:

Edit the API server pod specification file ``/etc/kubernetes/manifests/kube-apiserver.yaml` on the control plane node and set:

--anonymous-auth=false

Ensure load balancer health checks and any bootstrap processes authenticate to the API server.

Impact:

Disabling anonymous authentication entirely may break health check probes from load balancers unless those systems are configured to authenticate. Restricting anonymous auth to specific paths via AuthenticationConfiguration avoids this issue while still limiting the attack surface.

See Also

https://workbench.cisecurity.org/benchmarks/26886

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 8667cec5cbc0800f44f0d525201abe341514073c9db980a03bffaf317d83e324