An EKS Cluster's Kubelet configuration file should disable anonymous requests

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

Amazon EKS worker nodes should disable anonymous authentication on the kubelet so unauthenticated requests are rejected with 401 Unauthorized instead of being processed as the system:anonymous user. Confirm the effective setting authentication.anonymous.enabled resolves to false in the live kubelet configuration exposed at /configz, rather than relying solely on the kubelet process flags, since EKS can source kubelet settings from a config file, drop-in files, and command-line flags.

Remediation

Remediate through the supported node provisioning or node update workflow rather than editing the kubelet config file on the host, because host-level edits can be overridden or lost when nodes are recycled or replaced.

  1. Set authentication.anonymous.enabled: false in the worker node bootstrap configuration, for example in a custom launch template user data or NodeConfig, so the setting is present when nodes first join the cluster.
  2. Apply the updated launch template to the managed node group and replace or roll the existing nodes so the running fleet is rebuilt with the corrected setting, then re-audit the live kubelet configuration to confirm the effective value is false.

References