The --token-auth-file argument is Set misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_70
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize

Impact

Do not use token based authentication. The token-based authentication utilizes static tokens to authenticate requests to the apiserver. The tokens are stored in clear-text in a file on the apiserver, and cannot be revoked or rotated without restarting the apiserver. Hence, do not use static token-based authentication.

How to Fix

Kind Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:
• kube-apiserver image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 livenessProbe: failureThreshold: 8 httpGet: host: 127.0.0.1 path: /healthz port: 6443 scheme: HTTPS initialDelaySeconds: 15 timeoutSeconds: 15 name: kube-apiserver resources: requests: cpu: 250m volumeMounts:
• mountPath: /etc/kubernetes/ name: k8s readOnly: true
• mountPath: /etc/ssl/certs name: certs
• mountPath: /etc/pki name: pki hostNetwork: true volumes:
• hostPath: path: /etc/kubernetes name: k8s
• hostPath: path: /etc/ssl/certs name: certs
• hostPath: path: /etc/pki name: pki", }

---