Back to Checks
kubernetes

Kubelet --authorization-mode is not set to AlwaysAllow

kubelet_authorization_mode
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityidentity-access
Resource Type:ConfigMap

Kubernetes Kubelet authorization configuration is inspected to confirm the mode is not AlwaysAllow.

If authorization settings are absent, the effective mode requires manual verification.

Prowler logoProwlerprowler-provider-kubernetes

Risk

With AlwaysAllow, any authenticated user (or anonymous if enabled) can call kubelet APIs. This enables reading logs and stats, running exec, or disrupting pods, leading to takeover, data exfiltration, and node abuse, degrading confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_authorization_mode

Recommendation

Use kubelet authorization mode Webhook so decisions defer to RBAC. Apply least privilege on node subresources, disable anonymous access, and restrict network exposure of the kubelet endpoint. Employ defense in depth with TLS and audit to monitor and control access.

Remediation

Other

1In your cluster admin shell, run: kubectl -n kube-system edit configmap kubelet-config-<version>
2In the opened YAML, set the authorization mode to Webhook (add if missing):
3authorization:
4mode: Webhook
5Save and exit. Re-run the scan to confirm the finding is now PASS.

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_authorization_mode(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            authorization = cm.kubelet_args.get("authorization")
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if not authorization:
                report.status = "MANUAL"
                report.status_extended = f"Kubelet does not have the argument `readOnlyPort` in config file {cm.name}, verify it in the node's arguments."
            else:
                report.status = "PASS"
                report.status_extended = f"Kubelet is not using 'AlwaysAllow' as the authorization mode in config file {cm.name}."
                if authorization.get("mode") == "AlwaysAllow":
                    report.status = "FAIL"
                    report.status_extended = f"Kubelet is incorrectly set to use 'AlwaysAllow' as the authorization mode in config file {cm.name}."
            findings.append(report)
        return findings

References