Ensure that the Anonymous Auth is Not Enabled

MEDIUM

Description

Description:

Disable anonymous requests to the Kubelet server.

Rationale:

When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the Kubelet server. You should rely on authentication to authorize access and disallow anonymous requests.

Anonymous requests will be rejected.

Remediation

Remediation Method 1:

If configuring via the Kubelet config file, you first need to locate the file.

To do this, SSH to each node and execute the following command to find the kubelet process:

ps -ef | grep kubelet

The output of the above command provides details of the active kubelet process, from which we can see the location of the configuration file provided to the kubelet service with the '--config' argument. The file can be viewed with a command such as 'more' or 'less', like so:

sudo less /path/to/kubelet-config.json

Disable Anonymous Authentication by setting the following parameter:

"authentication": { "anonymous": { "enabled": false } }

Remediation Method 2:

If using executable arguments, edit the kubelet service file on each worker node and ensure the below parameters are part of the 'KUBELET_ARGS' variable string.

For systems using 'systemd', such as the Amazon EKS Optimised Amazon Linux or Bottlerocket AMIs, then this file can be found at '/etc/systemd/system/kubelet.service.d/10-kubelet-args.conf'. Otherwise, you may need to look up documentation for your chosen operating system to determine which service manager is configured:

--anonymous-auth=false

For Both Remediation Steps:

Based on your system, restart the 'kubelet' service and check the service status.

The following example is for operating systems using 'systemd', such as the Amazon EKS Optimised Amazon Linux or Bottlerocket AMIs, and invokes the 'systemctl' command. If 'systemctl' is not available then you will need to look up documentation for your chosen operating system to determine which service manager is configured:

systemctl daemon-reload
systemctl restart kubelet.service
systemctl status kubelet -l