The --authorization-mode argument does not include node misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_75
Category - Subcategory	Kubernetes - Access Control
Provider	OTHER
Severity	MEDIUM
Framework	Helm, Kubernetes, Kustomize

Impact

Restrict kubelet nodes to reading only objects associated with them. The Node authorization mode only allows kubelets to read Secret, ConfigMap, PersistentVolume, and PersistentVolumeClaim objects associated with their nodes.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:
• • kube-apiserver
• • --authorization-mode=RBAC,Node image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 ...", }

---