Project: KICS (Provisioning / Security & Compliance)
File: f1f4d8da-1ac4-47d0-b1aa-91e69d33f7d5.md

title: Authorization Mode Set To Always Allow hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: f1f4d8da-1ac4-47d0-b1aa-91e69d33f7d5 Query name: Authorization Mode Set To Always Allow Platform: Kubernetes Severity: <span style="color:#bb2124">High</span> Category: Access Control URL: When using the kubelet command, the authorization-mode flag should not have 'AlwaysAllow' mode<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--anonymous-auth=false", "--authorization-mode=MyMode,AlwaysAllow"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver", "--authorization-mode=MyMode,AlwaysAllow"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--anonymous-auth=false", "--authorization-mode=MyMode,AlwaysAllow"] restartPolicy: OnFailure ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet", "--authorization-mode=MyMode,AlwaysAllow"] restartPolicy: OnFailure ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="11" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false readOnlyPort: 0 authentication: anonymous: enabled: false authorization: mode: AlwaysAllow ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="6" { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "address": "0.0.0.0", "authorization": { "mode": "AlwaysAllow" } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--authorization-mode=MyMode"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver", "--authorization-mode=MyMode"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--authorization-mode=MyMode"] restartPolicy: OnFailure ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet", "--authorization-mode=MyMode"] restartPolicy: OnFailure ``` </details> <details><summary>Negative test num. 5 - yaml file</summary> ```yaml apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false readOnlyPort: 0 authentication: anonymous: enabled: false authorization: mode: webhook ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "address": "0.0.0.0", "authorization": { "mode": "webhook" } } ``` </details>