Details

Do not allow all requests.

Rationale:

Setting admission control policy to ‘AlwaysAdmit’ allows all requests and do not filter any requests.

Solution

Edit the API server pod specification file ‘/etc/kubernetes/manifests/kube-apiserver.yaml’ on the master node and set the ‘–admission-control’ parameter to a value that does not include ‘AlwaysAdmit’.

Impact:

Only requests explicitly allowed by the admissions control policy would be served.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/1788

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.

References

• 800-53|AC-6
• CSCv6|14

Source

• Tenable.com/audits