The --authorization-mode argument is set to AlwaysAllow for Kubelet misconfiguration detected in cod

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_74
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize

Impact

Do not always authorize all requests. The API Server, can be configured to allow all requests. This mode should not be used on any production cluster.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:
• • kube-apiserver
• • --authorization-mode=RBAC,node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 ...", }

---