For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-jhc.md. A documentation index is available at /llms.txt.

An EKS Cluster's Kubelet should only allow explicitly authorized requests

eks

Description

EKS worker node kubelets should resolve their effective authorization mode to Webhook so that kubelet API requests are explicitly authorized through the Kubernetes SubjectAccessReview API. An AlwaysAllow mode permits requests without webhook-based authorization and is noncompliant; a null or missing value indicates the live configz output should be re-verified.

Remediation

  1. Define authorization.mode: Webhook in the worker node bootstrap configuration (launch template user data or NodeConfig) so nodes join the cluster with the correct setting. See the EKS launch template documentation.
  2. For an existing node group, update the managed node group launch template version and roll or replace the nodes so EKS recycles each node from the corrected configuration, then re-audit the live kubelet configz output to confirm the effective value is Webhook. Avoid editing the kubelet config file directly on the host, as host-level edits can be overridden or lost when nodes are recycled.

References