Check ID: kubelet_disable_anonymous_auth
Provider: Kubernetes
Service: kubelet
Severity: HIGH
Categories: identity-access, cluster-security
Resource type: ConfigMap

​
What this check verifies

Kubernetes Kubelet configuration for its HTTPS endpoint is evaluated to ensure anonymous authentication is disabled, requiring authenticated requests (authentication.anonymous.enabled=false).

​
Risk

Allowing anonymous access to the kubelet exposes node and pod data and can permit privileged actions, impacting CIA: disclosure via logs/metrics (C), unauthorized container operations or exec (I), and pod or node disruption (A). This can enable lateral movement and broader cluster compromise.

​
Recommendation

Disable anonymous auth and require strong, authenticated clients (mTLS or tokens). Delegate authorization to RBAC and apply least privilege for kubelet APIs. Limit network exposure to the kubelet endpoint and monitor access patterns as part of defense in depth.

​
Remediation

Dashboard steps
  1. SSH to each Kubernetes node with root privileges
  2. Edit /var/lib/kubelet/config.yaml and set the following:
# Critical: disables anonymous requests to the kubelet
authentication:
  anonymous:
    enabled: false
  1. Restart kubelet:
sudo systemctl restart kubelet

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_disable_anonymous_auth. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks