Project: KICS (Provisioning / Security & Compliance)
File: 1de5cc51-f376-4638-a940-20f2e85ae238.md

title: Anonymous Auth Is Not Set To False hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 1de5cc51-f376-4638-a940-20f2e85ae238 Query name: Anonymous Auth Is Not Set To False Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Access Control URL: When using the kubelet or kube-apiserver command, the 'anonymous-auth' flag should be set to false (--anonymous-auth=false)<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver", "--anonymous-auth=true"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--anonymous-auth=true"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet", "--anonymous-auth=true"] restartPolicy: OnFailure ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--anonymous-auth=true"] restartPolicy: OnFailure ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="9" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false readOnlyPort: 0 authentication: anonymous: enabled: true ``` </details> <details><summary>Positive test num. 6 - json file</summary> ```json hl_lines="7" { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "address": "0.0.0.0", "authentication": { "anonymous": { "enabled": true } } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver", "--anonymous-auth=false"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--anonymous-auth=false"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--anonymous-auth=false"] restartPolicy: OnFailure ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet", "--anonymous-auth=false"] restartPolicy: OnFailure ``` </details> <details><summary>Negative test num. 5 - yaml file</summary> ```yaml apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 serializeImagePulls: false readOnlyPort: 0 ``` </details> <details><summary>Negative test num. 6 - json file</summary> ```json { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "address": "0.0.0.0", "authentication": { "anonymous": { "enabled": false } } } ``` </details>