API server pod has Node in --authorization-mode

​

What this check verifies

Kubernetes API server authorization settings include the Node authorizer in --authorization-mode. The evaluation looks for Node among the configured modes.

​

Risk

Without Node authorization, kubelet identities may gain overly broad permissions via other modes. A compromised node could read unrelated Secrets, enumerate cluster workloads, or alter node/pod status, degrading confidentiality and integrity and enabling lateral movement.

​

Recommendation

Include Node alongside RBAC by adding Node to --authorization-mode. Apply least privilege so kubelets are limited to their node and bound pods, and use NodeRestriction for defense in depth. Periodically review kubelet permissions and audit access.

​

Remediation

Dashboard steps

1. SSH to the control plane node
2. Open /etc/kubernetes/manifests/kube-apiserver.yaml
3. Under spec.containers[0].command, ensure the flag includes Node:
   • If —authorization-mode=… exists, add Node to the comma-separated list
   • If missing, add a new entry: - —authorization-mode=Node
4. Save the file; the kubelet will restart the API server automatically

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
• https://kubernetes.io/docs/reference/access-authn-authz/node/
• https://docs.kics.io/2.0.0/queries/kubernetes-queries/4d7ee40f-fc5d-427d-8cac-dffbe22d42d1/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_auth_mode_include_node. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks