Detections
Analytics

4.2.3 Ensure that the --authorization-mode argument is not set to AlwaysAllow

Information

Do not allow all requests. Enable explicit authorization.

Kubelets, by default, allow all authenticated requests (even anonymous ones) without needing explicit authorization checks from the apiserver. You should restrict this behavior and only allow explicitly authorized requests.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

None.

Impact:

Unauthorized requests will be denied.

See Also

https://workbench.cisecurity.org/benchmarks/24114

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|9.2

Plugin: OpenShift

Control ID: 7c61da5e2fafc358acbe90fafd9eaf7aabcd8ef2b13e3d80a8b6e2592180ab93