The --authorization-mode argument is set to AlwaysAllow for API server misconfiguration detected in

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_139
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize

Impact

Do not allow all requests. Enable explicit authorization. Kubelets, by default, allow all authenticated requests (even anonymous ones) without needing explicit authorization checks from the apiserver. You should restrict this behavior and only allow explicitly authorized requests.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers:

• command:

• • kubelet

• • --authorization-mode=RBAC,node image: gcr.io/google_containers/kubelet-amd64:v1.6.0 ...", }

---