---
title: An EKS Cluster's Kubelet configuration file should disable anonymous requests
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > An EKS Cluster's Kubelet configuration
  file should disable anonymous requests
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# An EKS Cluster's Kubelet configuration file should disable anonymous requests
 
## Description{% #description %}

Amazon EKS worker nodes should disable anonymous authentication on the kubelet so unauthenticated requests are rejected with `401 Unauthorized` instead of being processed as the `system:anonymous` user. Confirm the effective setting `authentication.anonymous.enabled` resolves to `false` in the live kubelet configuration exposed at `/configz`, rather than relying solely on the kubelet process flags, since EKS can source kubelet settings from a config file, drop-in files, and command-line flags.

## Remediation{% #remediation %}

Remediate through the supported node provisioning or node update workflow rather than editing the kubelet config file on the host, because host-level edits can be overridden or lost when nodes are recycled or replaced.

1. Set `authentication.anonymous.enabled: false` in the worker node bootstrap configuration, for example in a custom [launch template](https://docs.aws.amazon.com/eks/latest/userguide/launch-templates.html) user data or `NodeConfig`, so the setting is present when nodes first join the cluster.
1. Apply the updated launch template to the managed node group and replace or roll the existing nodes so the running fleet is rebuilt with the corrected setting, then re-audit the live kubelet configuration to confirm the effective value is `false`.

## References{% #references %}

- [Kubelet authentication and authorization](https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/)
- [Reconfiguring the kubelet (configz)](https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/)
- [CIS Amazon EKS Benchmark](https://www.cisecurity.org/benchmark/kubernetes)