Details
Do not use token based authentication.
Rationale:
The token-based authentication utilizes static tokens to authenticate requests to the apiserver. The tokens are stored in clear-text in a file on the apiserver, and cannot be revoked or rotated without restarting the apiserver. Hence, do not use static token-based authentication.
Solution
Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file ‘/etc/kubernetes/manifests/kube-apiserver.yaml’ on the master node and remove the ‘–token-auth-file=’ parameter.
Impact:
You will have to configure and use alternate authentication mechanisms such as certificates. Static token based authentication could not be used.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Unix.