API server does not use the AlwaysAllow authorization mode

​

What this check verifies

Kubernetes API server authorization is evaluated via the --authorization-mode setting to detect any use of AlwaysAllow. The focus is whether policy-driven authorizers are configured instead of an allow-all mode.

​

Risk

AlwaysAllow permits all API requests, eroding confidentiality (secrets readable), integrity (privilege escalation, role changes, config edits), and availability (object deletion, cluster disruption). Enables rapid cluster takeover and data exfiltration.

​

Recommendation

Use policy-based authorization and avoid AlwaysAllow. Prefer RBAC with Node (and Webhook if needed) to enforce least privilege and separation of duties. Define granular roles, avoid broad bindings like cluster-admin, and audit access for defense in depth.

​

Remediation

Dashboard steps

1. SSH to the control plane node
2. Edit the API server static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3. In the kube-apiserver container args, set the authorization mode (add or replace if present):
   - --authorization-mode=RBAC
   
4. Save the file; the kubelet will automatically restart the API server with the updated setting

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
• https://kubernetes.io/docs/reference/access-authn-authz/authorization/#using-flags-for-your-authorization-module

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_auth_mode_not_always_allow. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks