Ensure that anonymous requests to the API server are restricted

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

Determine which anonymous authentication mode is in use: # Check for structured authentication configuration AUTH_CONFIG=$(ps -ef | grep kube-apiserver | grep -oP '(?<=--authentication-config[= ])\S+') # Check for the --anonymous-auth flag ANON_AUTH=$(ps -ef | grep kube-apiserver | grep -oP '(?<=--anonymous-auth[= ])\S+') If --authentication-config is set Inspect the file for anonymous auth restrictions: cat "$AUTH_CONFIG" | grep -A 10 "anonymous:" Verify one of: • enabled: false — anonymous auth is fully disabled, or • enabled: true with a conditions list restricting access to only ...

修補方式

修補方法: 操作指南或基礎設施修補檔

Option 1 — Structured authentication configuration Add an anonymous section to the AuthenticationConfiguration file to restrict anonymous access to only required endpoints: apiVersion: apiserver.config.k8s.io/v1beta1 kind: AuthenticationConfiguration anonymous: enabled: true conditions: - path: /healthz - path: /livez - path: /readyz Start the API server with --authentication-config pointing to this file. Remove the --anonymous-auth flag if present. Option 2 — Disable anonymous authentication entirely: Edit the API server pod specification file ``/etc/kubernetes/manifests/kube-apiserver.yaml` on the control plane node and set: --anonymous-auth=false Ensure load balancer health checks and any bootstrap processes authenticate to the API server.