API server disables the AlwaysAdmit admission plugin

​

What this check verifies

Kubernetes API server configuration is inspected for the AlwaysAdmit admission plugin in --enable-admission-plugins. If AlwaysAdmit is configured, the server accepts all admission requests without running other admission controllers.

​

Risk

With AlwaysAdmit, admission policies don’t run after authN/Z, weakening CIA:

• Bypass of controls enables privileged or unsafe workloads (confidentiality, integrity)
• Quotas/limits can be ignored, causing resource exhaustion (availability)
• Misconfigurations persist, enabling escalation and lateral movement

​

Recommendation

Exclude AlwaysAdmit from API server settings. Use a deny-by-default admission posture and enable only necessary controllers to enforce policy and limits (e.g., PodSecurity, ResourceQuota, LimitRanger). Apply least privilege, regularly review admission configuration, and audit API activity to detect drift.

​

Remediation

Dashboard steps

1. SSH to a control plane node
2. Edit the static pod manifest: sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
3. In spec.containers[].command, locate the flag —enable-admission-plugins=…
4. Remove “AlwaysAdmit” from the comma-separated list (if it is the only value, remove the entire flag)
5. Save the file; the kubelet will restart the API server automatically
6. Verify it’s gone: kubectl -n kube-system describe pod <example_apiserver_pod> | grep — —enable-admission-plugins (ensure AlwaysAdmit is not present)

​

References

• https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwaysadmit

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_no_always_admit_plugin. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks