Check ID: apiserver_node_restriction_plugin
Provider: Kubernetes
Service: apiserver
Severity: HIGH
Categories: cluster-security, identity-access, trust-boundaries
Resource type: Pod

​
What this check verifies

Kubernetes API server has the NodeRestriction admission controller enabled via --enable-admission-plugins. This setting confines kubelets to modify only their own Node object and bound Pod objects.

​
Risk

Without NodeRestriction, a compromised or misconfigured kubelet could alter other nodes or pods, change critical labels/taints, or delete node objects. This enables lateral movement and workload hijacking, impacting integrity and availability of the cluster.

​
Recommendation

Enable the NodeRestriction admission controller to enforce least privilege for kubelets. Pair it with Node and RBAC authorization, strong kubelet identity, and audit monitoring for defense-in-depth. Regularly rotate credentials and limit kubelet access to only its node.

​
Remediation

Dashboard steps
  1. SSH to the control plane node running the API server
  2. Edit the static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
  3. Under spec > containers[0] > command, ensure this flag is present and includes NodeRestriction (add it if missing):
    • —enable-admission-plugins=NodeRestriction If the flag already exists with other plugins, append ,NodeRestriction to the comma-separated list
  4. Save the file; the kubelet will automatically restart the API server

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_node_restriction_plugin. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks