Ensure kubelet authorization mode is set to Webhook

How it is checked

Audit method: Shell command

nodes=$(kubectl get nodes -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}') || exit 1
[ -n "$nodes" ] || exit 1
ok=1
for n in $nodes; do
  c=$(kubectl get --raw "/api/v1/nodes/$n/proxy/configz") || exit 1
  if ! { printf '%s' "$c" | grep -Eq '"authorization":\{"mode":"Webhook"'; }; then echo "noncompliant: $n"; ok=0; fi
done
if [ "$ok" -eq 1 ]; then echo compliant; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

If the audit returns AlwaysAllow, the worker node is permitting kubelet requests without webhook-based authorization and should be treated as noncompliant. If the result is null or the field is missing, first confirm the configz response is complete, because Kubernetes identifies that endpoint as the view of the kubelet’s final actuated configuration. Once the result is validated, remediation in EKS should be performed through the supported node provisioning or node update workflow, not by directly editing the kubelet config file on the host. AWS documents that EKS merges managed node bootstrap user data, treats kubelet authorization as a managed field in EKS tooling, and applies launch template updates to running managed node groups by recycling nodes.

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target eks