Ensure that anonymous requests to the API server are restricted

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Determine which anonymous authentication mode is in use: # Check for structured authentication configuration AUTH_CONFIG=$(ps -ef | grep kube-apiserver | grep -oP '(?<=--authentication-config[= ])\S+') # Check for the --anonymous-auth flag ANON_AUTH=$(ps -ef | grep kube-apiserver | grep -oP '(?<=--anonymous-auth[= ])\S+') If --authentication-config is set Inspect the file for anonymous auth restrictions: cat "$AUTH_CONFIG" | grep -A 10 "anonymous:" Verify one of: • enabled: false — anonymous auth is fully disabled, or • enabled: true with a conditions list restricting access to only ...

修正方法

修正方法: ガイダンスまたは IaC パッチ

Option 1 — Structured authentication configuration Add an anonymous section to the AuthenticationConfiguration file to restrict anonymous access to only required endpoints: apiVersion: apiserver.config.k8s.io/v1beta1 kind: AuthenticationConfiguration anonymous: enabled: true conditions: - path: /healthz - path: /livez - path: /readyz Start the API server with --authentication-config pointing to this file. Remove the --anonymous-auth flag if present. Option 2 — Disable anonymous authentication entirely: Edit the API server pod specification file ``/etc/kubernetes/manifests/kube-apiserver.yaml` on the control plane node and set: --anonymous-auth=false Ensure load balancer health checks and any bootstrap processes authenticate to the API server.