Details

Disable anonymous requests to the API server.

Rationale:

When enabled, requests that are not rejected by other configured authentication methods are treated as anonymous requests. These requests are then served by the API server. You should rely on authentication to authorize access and disallow anonymous requests.

Solution

Edit the API server pod specification file ‘/etc/kubernetes/manifests/kube-apiserver.yaml’ on the master node and set the below parameter.

–anonymous-auth=false

Impact:

Anonymous requests will be rejected.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/2125

This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Unix.

References

• 800-53|IA-2
• CSCv6|14

Source

• Tenable.com/audits