Kubelet --authorization-mode is not set to AlwaysAllow

​

What this check verifies

Kubernetes Kubelet authorization configuration is inspected to confirm the mode is not AlwaysAllow. If authorization settings are absent, the effective mode requires manual verification.

​

Risk

With AlwaysAllow, any authenticated user (or anonymous if enabled) can call kubelet APIs. This enables reading logs and stats, running exec, or disrupting pods, leading to takeover, data exfiltration, and node abuse, degrading confidentiality, integrity, and availability.

​

Recommendation

Use kubelet authorization mode Webhook so decisions defer to RBAC. Apply least privilege on node subresources, disable anonymous access, and restrict network exposure of the kubelet endpoint. Employ defense in depth with TLS and audit to monitor and control access.

​

Remediation

Dashboard steps

1. In your cluster admin shell, run: kubectl -n kube-system edit configmap kubelet-config-<version>
2. In the opened YAML, set the authorization mode to Webhook (add if missing): authorization: mode: Webhook
3. Save and exit. Re-run the scan to confirm the finding is now PASS.

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
• https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/
• https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_authorization_mode. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks