An EKS Cluster's Kubelet should only allow explicitly authorized requests

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

EKS worker node kubelets should resolve their effective authorization mode to Webhook so that kubelet API requests are explicitly authorized through the Kubernetes SubjectAccessReview API. An AlwaysAllow mode permits requests without webhook-based authorization and is noncompliant; a null or missing value indicates the live configz output should be re-verified.

Remediation

  1. Define authorization.mode: Webhook in the worker node bootstrap configuration (launch template user data or NodeConfig) so nodes join the cluster with the correct setting. See the EKS launch template documentation.
  2. For an existing node group, update the managed node group launch template version and roll or replace the nodes so EKS recycles each node from the corrected configuration, then re-audit the live kubelet configz output to confirm the effective value is Webhook. Avoid editing the kubelet config file directly on the host, as host-level edits can be overridden or lost when nodes are recycled.

References