API server pod has anonymous-auth disabled

​

What this check verifies

Kubernetes API server anonymous authentication configuration, identified by --anonymous-auth=true. With this setting, unauthenticated requests are mapped to system:anonymous and processed by the server.

​

Risk

Anonymous API access exposes cluster details for reconnaissance and enumeration, eroding confidentiality. If RBAC is misconfigured, unauthenticated users may read sensitive data or trigger actions, impacting integrity. Floods of anonymous requests can also reduce availability.

​

Recommendation

Require authenticated access for all API requests and avoid reliance on anonymous users. Enforce least privilege RBAC for explicit principals only. If health checks must be public, restrict to minimal paths and methods. Add network segmentation, mutual TLS, and audit logging for defense in depth.

​

Remediation

Dashboard steps

1. SSH to the control plane node
2. Edit the API server static Pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3. In spec.containers[].command or args, remove “—anonymous-auth=true” or replace it with:
   - --anonymous-auth=false
   
4. Save the file; the kubelet will automatically restart the API server with the updated flag

​

References

• https://cloud.hacktricks.wiki/en/pentesting-cloud/kubernetes-security/pentesting-kubernetes-services/index.html
• https://docs.kics.io/develop/queries/kubernetes-queries/1de5cc51-f376-4638-a940-20f2e85ae238/
• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_anonymous_requests. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks