Ensure that the --authorization-mode argument is not set to AlwaysAllow

So wird geprüft

Prüfmethode: Shell-Befehl

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { ! printf '%s' "$c" | grep -Eq '"authorization":\{"mode":"AlwaysAllow"' && printf '%s' "$c" | grep -Eq '"authorization":\{"mode":"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Erwartete Ausgabe

compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

If the --authorization-mode parameter is not set to Webhook and manual modification is required, review the following file, which contains the KUBELET_FLAGS values used to build the kubelet command-line parameters. /etc/default/kubelet Before editing anything, enter debug mode and run chroot to verify what your node is actually using: kubectl debug node/$NODE_NAME -it --image=$IMAGE --profile=general chroot /host systemctl cat kubelet If the service shows an EnvironmentFile=/etc/default/kubelet or references KUBELET_FLAGS, that is the file you would edit. If it does not, then the next place to check is the kubelet systemd unit or drop-in, such as: /etc/systemd/system/kubelet.service /etc/systemd/system/kubelet.service.d/*.conf After a changing the kubelet config file, restart the kubelet service and check status.

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

tmaegis scan --target aks