Back to Checks
kubernetes

API server pod has NodeRestriction admission control plugin enabled

apiserver_node_restriction_plugin
Service: apiserverSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-accesstrust-boundaries
Resource Type:Pod

Kubernetes API server has the NodeRestriction admission controller enabled via --enable-admission-plugins.

This setting confines kubelets to modify only their own Node object and bound Pod objects.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without NodeRestriction, a compromised or misconfigured kubelet could alter other nodes or pods, change critical labels/taints, or delete node objects.

This enables lateral movement and workload hijacking, impacting integrity and availability of the cluster.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_node_restriction_plugin

Recommendation

Enable the NodeRestriction admission controller to enforce least privilege for kubelets.

Pair it with Node and RBAC authorization, strong kubelet identity, and audit monitoring for defense-in-depth. Regularly rotate credentials and limit kubelet access to only its node.

Remediation

Other

1SSH to the control plane node running the API server
2Edit the static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3Under spec > containers[0] > command, ensure this flag is present and includes NodeRestriction (add it if missing):
4- --enable-admission-plugins=NodeRestriction
5If the flag already exists with other plugins, append ,NodeRestriction to the comma-separated list
6Save the file; the kubelet will automatically restart the API server

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_node_restriction_plugin(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"NodeRestriction admission control plugin is set in pod {pod.name}."
            )
            node_restriction_plugin_set = False
            for container in pod.containers.values():
                node_restriction_plugin_set = False
                # Check if "--enable-admission-plugins" includes "NodeRestriction"
                for command in container.command:
                    if command.startswith("--enable-admission-plugins"):
                        if "NodeRestriction" in (command.split("=")[1]):
                            node_restriction_plugin_set = True
                if not node_restriction_plugin_set:
                    break

            if not node_restriction_plugin_set:
                report.status = "FAIL"
                report.status_extended = f"NodeRestriction admission control plugin is not set in pod {pod.name}."

            findings.append(report)
        return findings

References