Ensure that anonymous requests to the API server are restricted

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Determine which anonymous authentication mode is in use: # Check for structured authentication configuration AUTH_CONFIG=$(ps -ef | grep kube-apiserver | grep -oP '(?<=--authentication-config[= ])\S+') # Check for the --anonymous-auth flag ANON_AUTH=$(ps -ef | grep kube-apiserver | grep -oP '(?<=--anonymous-auth[= ])\S+') If --authentication-config is set Inspect the file for anonymous auth restrictions: cat "$AUTH_CONFIG" | grep -A 10 "anonymous:" Verify one of: • enabled: false — anonymous auth is fully disabled, or • enabled: true with a conditions list restricting access to only ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

Option 1 — Structured authentication configuration Add an anonymous section to the AuthenticationConfiguration file to restrict anonymous access to only required endpoints: apiVersion: apiserver.config.k8s.io/v1beta1 kind: AuthenticationConfiguration anonymous: enabled: true conditions: - path: /healthz - path: /livez - path: /readyz Start the API server with --authentication-config pointing to this file. Remove the --anonymous-auth flag if present. Option 2 — Disable anonymous authentication entirely: Edit the API server pod specification file ``/etc/kubernetes/manifests/kube-apiserver.yaml` on the control plane node and set: --anonymous-auth=false Ensure load balancer health checks and any bootstrap processes authenticate to the API server.