API server pod authorization mode includes RBAC

​

What this check verifies

Kubernetes API server authorization configuration includes the RBAC authorizer in the enabled modes, i.e., RBAC appears in the authorizer chain.

​

Risk

Absence of RBAC removes fine-grained, role-scoped control. Identities may gain broad or unintended access, enabling:

• Secret disclosure (confidentiality)
• Unauthorized changes to workloads/policies (integrity)
• Destructive API calls causing outages (availability)

​

Recommendation

Adopt RBAC as the primary authorizer and avoid permissive modes like AlwaysAllow or legacy ABAC. Enforce least privilege with narrowly scoped roles and bindings, apply separation of duties, and monitor authorization activity for defense in depth.

​

Remediation

Dashboard steps

1. SSH to each control-plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. In spec.containers[].command, add or update the flag to include RBAC, for example:
   • —authorization-mode=Node,RBAC (If —authorization-mode already exists, append ,RBAC to its value)
4. Save the file; the kubelet will restart the API server automatically

​

References

• https://kubernetes.io/docs/reference/access-authn-authz/rbac/
• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_auth_mode_include_rbac. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks