Back to Checks
kubernetes

API server pod authorization mode includes RBAC

apiserver_auth_mode_include_rbac
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Kubernetes API server authorization configuration includes the RBAC authorizer in the enabled modes, i.e., RBAC appears in the authorizer chain.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Absence of RBAC removes fine-grained, role-scoped control. Identities may gain broad or unintended access, enabling:

  • Secret disclosure (confidentiality)
  • Unauthorized changes to workloads/policies (integrity)
  • Destructive API calls causing outages (availability)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_auth_mode_include_rbac

Recommendation

Adopt RBAC as the primary authorizer and avoid permissive modes like AlwaysAllow or legacy ABAC.

Enforce least privilege with narrowly scoped roles and bindings, apply separation of duties, and monitor authorization activity for defense in depth.

Remediation

Other

1SSH to each control-plane node
2Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3In spec.containers[].command, add or update the flag to include RBAC, for example:
4- --authorization-mode=Node,RBAC
5(If --authorization-mode already exists, append ,RBAC to its value)
6Save the file; the kubelet will restart the API server automatically

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_auth_mode_include_rbac(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"API Server authorization mode includes RBAC in pod {pod.name}."
            )
            rbac_auth_mode_set = False
            for container in pod.containers.values():
                rbac_auth_mode_set = False
                for command in container.command:
                    if command.startswith("--authorization-mode"):
                        if "RBAC" in (command.split("=")[1]):
                            rbac_auth_mode_set = True
                            break
                if not rbac_auth_mode_set:
                    break
            if not rbac_auth_mode_set:
                report.status = "FAIL"
                report.status_extended = f"API Server authorization mode does not include RBAC in pod {pod.name}."
            findings.append(report)
        return findings

References