Back to Checks
kubernetes

API server pod does not have the AlwaysAdmit admission control plugin enabled

apiserver_no_always_admit_plugin
Service: apiserverSeverity: critical
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:Pod

Kubernetes API server configuration is inspected for the AlwaysAdmit admission plugin in --enable-admission-plugins.

If AlwaysAdmit is configured, the server accepts all admission requests without running other admission controllers.

Prowler logoProwlerprowler-provider-kubernetes

Risk

With AlwaysAdmit, admission policies don't run after authN/Z, weakening CIA:

  • Bypass of controls enables privileged or unsafe workloads (confidentiality, integrity)
  • Quotas/limits can be ignored, causing resource exhaustion (availability)
  • Misconfigurations persist, enabling escalation and lateral movement

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_no_always_admit_plugin

Recommendation

Exclude AlwaysAdmit from API server settings. Use a deny-by-default admission posture and enable only necessary controllers to enforce policy and limits (e.g., PodSecurity, ResourceQuota, LimitRanger).

Apply least privilege, regularly review admission configuration, and audit API activity to detect drift.

Remediation

Other

1SSH to a control plane node
2Edit the static pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3In spec.containers[].command, locate the flag --enable-admission-plugins=...
4Remove "AlwaysAdmit" from the comma-separated list (if it is the only value, remove the entire flag)
5Save the file; the kubelet will restart the API server automatically
6Verify it's gone: kubectl -n kube-system describe pod <example_apiserver_pod> | grep -- --enable-admission-plugins (ensure AlwaysAdmit is not present)

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_no_always_admit_plugin(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"AlwaysAdmit admission control plugin is not set in pod {pod.name}."
            )
            always_admit_plugin = True
            for container in pod.containers.values():
                always_admit_plugin = True
                for command in container.command:
                    if command.startswith("--enable-admission-plugins"):
                        if "AlwaysAdmit" in (command.split("=")[1]):
                            report.status = "FAIL"
                            report.status_extended = f"AlwaysAdmit admission control plugin is set in pod {pod.name}."
                            always_admit_plugin = False
                            break
                if not always_admit_plugin:
                    break
            findings.append(report)
        return findings

References