Ensure that the anonymous-auth argument is set to FAIL in kubelet configuration. Ensure the authorization-mode argument is not set to AlwaysAllow (use Webhook/AuthZ where possible) in kubelet configur

worker1 $ vim /var/lib/kubelet/config.yaml Modify the anonymous and authorization sections as follows: anonymous: enabled: false authorization: mode: Webhook worker1 $ systemctl restart kubelet. # To reload kubelet config ssh to master1 master1 $ vim /etc/kubernetes/manifests/kub

Submitted by renata2k· May 5, 2026Cluster Hardening

Question

Ensure that the anonymous-auth argument is set to FAIL in kubelet configuration. Ensure the authorization-mode argument is not set to AlwaysAllow (use Webhook/AuthZ where possible) in kubelet configuration and kube-apiserver manifest. Fix the following violation found against etcd: Ensure that the client-cert-auth argument is set to true.

Explanation

worker1 $ vim /var/lib/kubelet/config.yaml

Modify the anonymous and authorization sections as follows:

anonymous: enabled: false authorization: mode: Webhook worker1 $ systemctl restart kubelet. # To reload kubelet config

ssh to master1 master1 $ vim /etc/kubernetes/manifests/kube-apiserver.yaml

Add or modify the --authorization-mode argument to include Node,RBAC:

Example before:

- --authorization-mode=AlwaysAllow

Example after:

--authorization-mode=Node,RBAC

master1 $ vim /etc/kubernetes/manifests/etcd.yaml

Add or modify the --client-cert-auth argument:

--client-cert-auth=true

Topics

#Kubelet Hardening#API Server Hardening#Etcd Security#Authentication & Authorization

Community Discussion

No community discussion yet for this question.

Full CKS Practice