C-0120 - Ensure that the API Server --authorization-mode argument includes RBAC

Framework

cis-v1.23-t1.0.1

Severity

High

Description of the the issue

Role Based Access Control (RBAC) allows fine-grained control over the operations that different entities can perform on different objects in the cluster. It is recommended to use the RBAC authorization mode.

Related resources

Pod

What does this control test

Turn on Role Based Access Control.

How to check it manually

Run the following command on the Control Plane node:

ps -ef | grep kube-apiserver

Verify that the --authorization-mode argument exists and is set to a value to include RBAC.

Remediation

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the --authorization-mode parameter to a value that includes RBAC, for example:

--authorization-mode=Node,RBAC

Impact Statement

When RBAC is enabled you will need to ensure that appropriate RBAC settings (including Roles, RoleBindings and ClusterRoleBindings) are configured to allow appropriate access.

Default Value

By default, RBAC authorization is not enabled.

Example

No example