Back to Checks
kubernetes

API server pod has Node in --authorization-mode

apiserver_auth_mode_include_node
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Kubernetes API server authorization settings include the Node authorizer in --authorization-mode. The evaluation looks for Node among the configured modes.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without Node authorization, kubelet identities may gain overly broad permissions via other modes. A compromised node could read unrelated Secrets, enumerate cluster workloads, or alter node/pod status, degrading confidentiality and integrity and enabling lateral movement.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_auth_mode_include_node

Recommendation

Include Node alongside RBAC by adding Node to --authorization-mode. Apply least privilege so kubelets are limited to their node and bound pods, and use NodeRestriction for defense in depth. Periodically review kubelet permissions and audit access.

Remediation

Other

1SSH to the control plane node
2Open /etc/kubernetes/manifests/kube-apiserver.yaml
3Under spec.containers[0].command, ensure the flag includes Node:
4- If --authorization-mode=... exists, add Node to the comma-separated list
5- If missing, add a new entry: - --authorization-mode=Node
6Save the file; the kubelet will restart the API server automatically

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_auth_mode_include_node(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"API Server authorization mode includes Node in pod {pod.name}."
            )
            node_auth_mode_set = False
            for container in pod.containers.values():
                node_auth_mode_set = False
                for command in container.command:
                    if command.startswith("--authorization-mode"):
                        if "Node" in (command.split("=")[1]):
                            node_auth_mode_set = True
                            break
                if not node_auth_mode_set:
                    break
            if not node_auth_mode_set:
                report.status = "FAIL"
                report.status_extended = f"API Server authorization mode does not include Node in pod {pod.name}."
            findings.append(report)
        return findings

References