Back to Checks
kubernetes

Kubelet anonymous authentication is disabled

kubelet_disable_anonymous_auth
Service: kubeletSeverity: high
OfficialBuilt-inVerified
Categories:identity-accesscluster-security
Resource Type:ConfigMap

Kubernetes Kubelet configuration for its HTTPS endpoint is evaluated to ensure anonymous authentication is disabled, requiring authenticated requests (authentication.anonymous.enabled=false).

Prowler logoProwlerprowler-provider-kubernetes

Risk

Allowing anonymous access to the kubelet exposes node and pod data and can permit privileged actions, impacting CIA: disclosure via logs/metrics (C), unauthorized container operations or exec (I), and pod or node disruption (A). This can enable lateral movement and broader cluster compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_disable_anonymous_auth

Recommendation

Disable anonymous auth and require strong, authenticated clients (mTLS or tokens). Delegate authorization to RBAC and apply least privilege for kubelet APIs. Limit network exposure to the kubelet endpoint and monitor access patterns as part of defense in depth.

Remediation

Other

1SSH to each Kubernetes node with root privileges
2Edit /var/lib/kubelet/config.yaml and set the following:
3```yaml
4# Critical: disables anonymous requests to the kubelet
5authentication:
6anonymous:
7enabled: false
8```
9Restart kubelet:
10```bash
11sudo systemctl restart kubelet
12```

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_disable_anonymous_auth(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            authentication = cm.kubelet_args.get("authentication", {})
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            report.status = "FAIL"
            report.status_extended = (
                f"Kubelet has anonymous access enabled in config file {cm.name}."
            )
            if not authentication.get("anonymous", {}).get("enabled", False):
                report.status = "PASS"
                report.status_extended = f"Kubelet does not have anonymous access enabled in config file {cm.name}."
            findings.append(report)
        return findings

References