Back to Checks
kubernetes

API server pod has anonymous-auth disabled

apiserver_anonymous_requests
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Kubernetes API server anonymous authentication configuration, identified by --anonymous-auth=true. With this setting, unauthenticated requests are mapped to system:anonymous and processed by the server.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Anonymous API access exposes cluster details for reconnaissance and enumeration, eroding confidentiality.

If RBAC is misconfigured, unauthenticated users may read sensitive data or trigger actions, impacting integrity. Floods of anonymous requests can also reduce availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_anonymous_requests

Recommendation

Require authenticated access for all API requests and avoid reliance on anonymous users. Enforce least privilege RBAC for explicit principals only. If health checks must be public, restrict to minimal paths and methods. Add network segmentation, mutual TLS, and audit logging for defense in depth.

Remediation

Other

1SSH to the control plane node
2Edit the API server static Pod manifest:
3sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
4In spec.containers[].command or args, remove "--anonymous-auth=true" or replace it with:
5```
6- --anonymous-auth=false
7```
8Save the file; the kubelet will automatically restart the API server with the updated flag

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_anonymous_requests(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"API Server does not have anonymous-auth enabled in pod {pod.name}."
            )
            for container in pod.containers.values():
                if "--anonymous-auth=true" in container.command:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"API Server has anonymous-auth enabled in pod {pod.name}."
                    )
            findings.append(report)
        return findings

References