Back to Checks
kubernetes

API server pod does not use the AlwaysAllow authorization mode

apiserver_auth_mode_not_always_allow
Service: apiserverSeverity: critical
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:Pod

Kubernetes API server authorization is evaluated via the --authorization-mode setting to detect any use of AlwaysAllow. The focus is whether policy-driven authorizers are configured instead of an allow-all mode.

Prowler logoProwlerprowler-provider-kubernetes

Risk

AlwaysAllow permits all API requests, eroding confidentiality (secrets readable), integrity (privilege escalation, role changes, config edits), and availability (object deletion, cluster disruption). Enables rapid cluster takeover and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_auth_mode_not_always_allow

Recommendation

Use policy-based authorization and avoid AlwaysAllow. Prefer RBAC with Node (and Webhook if needed) to enforce least privilege and separation of duties. Define granular roles, avoid broad bindings like cluster-admin, and audit access for defense in depth.

Remediation

Other

1SSH to the control plane node
2Edit the API server static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3In the kube-apiserver container args, set the authorization mode (add or replace if present):
4```yaml
5- --authorization-mode=RBAC
6```
7Save the file; the kubelet will automatically restart the API server with the updated setting

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_auth_mode_not_always_allow(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"API Server authorization mode is not set to AlwaysAllow in pod {pod.name}."
            always_allow_in_auth_mode = True
            for container in pod.containers.values():
                always_allow_in_auth_mode = True
                for command in container.command:
                    if command.startswith("--authorization-mode"):
                        if "AlwaysAllow" not in (command.split("=")[1]):
                            always_allow_in_auth_mode = False
                            break
                if always_allow_in_auth_mode:
                    break
            if always_allow_in_auth_mode:
                report.status = "FAIL"
                report.status_extended = f"API Server authorization mode is set to AlwaysAllow in pod {pod.name}."
            findings.append(report)
        return findings

References