C-0120 - Ensure that the API Server --authorization-mode argument includes RBAC
Framework
cis-v1.23-t1.0.1
Severity
High
Description of the the issue
Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.
Related resources
Pod
What does this control test
Turn on Role Based Access Control.
How to check it manually
Run the following command on the Control Plane node:
ps -ef | grep kube-apiserver
Verify that the --authorization-mode
argument exists and is set to a value to include RBAC
.
Remediation
Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml
on the Control Plane node and set the --authorization-mode
parameter to a value that includes RBAC
, for example:
--authorization-mode=Node,RBAC
Impact Statement
When RBAC is enabled you will need to ensure that appropriate RBAC settings (including Roles, RoleBindings and ClusterRoleBindings) are configured to allow appropriate access.
Default Value
By default, RBAC
authorization is not enabled.
Example
No example
Updated 3 months ago