Check ID: apiserver_no_token_auth_file
Provider: Kubernetes
Service: apiserver
Severity: HIGH
Categories: cluster-security, identity-access
Resource type: Pod

​
What this check verifies

Kubernetes API server configuration is reviewed for use of static token file authentication by inspecting API server containers for the --token-auth-file argument

​
Risk

Using static bearer tokens undermines CIA:
  • Confidentiality: leaked tokens grant API access
  • Integrity: long-lived tokens enable unauthorized changes
  • Availability: access can’t be revoked quickly Tokens are clear-text and lack revocation/rotation, enabling persistent access if exposed.

​
Recommendation

Avoid static token files. Prefer client certificates, OIDC/webhook authenticators, or service accounts with short-lived tokens. Apply least privilege with RBAC, enforce rotation and short expirations, and disable --token-auth-file to support defense in depth and rapid credential revocation.

​
Remediation

Dashboard steps
  1. SSH to each control plane node
  2. Open /etc/kubernetes/manifests/kube-apiserver.yaml
  3. In spec.containers[0].command, remove the line containing: —token-auth-file=</path/to/file>
  4. Save the file; the kubelet will automatically restart the API server
  5. Repeat on all control plane nodes
  6. Verify the flag is absent: kubectl -n kube-system get pods -l component=kube-apiserver -o yaml | grep — —token-auth-file || echo “not present”

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_no_token_auth_file. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks