documentation_complete: true


{{%- if product == "eks" %}}
{{%- set kubeletconf_path = "/etc/kubernetes/kubelet/kubelet-config.json" %}}
{{%- else %}}
{{%- set kubeletconf_path = "/etc/kubernetes/kubelet.conf" %}}
{{%- endif %}}

platform: {{{ product }}}-node

title: 'Disable Anonymous Authentication to the Kubelet'

description: |-
    By default, anonymous access to the Kubelet server is enabled. This
    configuration check ensures that anonymous requests to the Kubelet
    server are disabled. Edit the Kubelet server configuration file
    <tt>{{{ kubeletconf_path }}}</tt> on the kubelet node(s)
    and set the below parameter:
    <pre>
    authentication:
      ...
      anonymous:
        enabled: false
      ...
    </pre>

rationale: |-
    When enabled, requests that are not rejected by other configured
    authentication methods are treated as anonymous requests. These
    requests are then served by the Kubelet server. OpenShift Operators should
    rely on authentication to authorize access and disallow anonymous
    requests.

severity: medium

references:
    cis@eks: 3.2.1
    cis@ocp4: 4.2.2
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

identifiers:
      cce@ocp4: CCE-83815-1

ocil_clause: '<tt>anonymous</tt> authentication is not set to <tt>false</tt>'

ocil: |-
    Run the following command on the kubelet node(s):
    <pre>$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep -A1 anonymous; done</pre>
    The output should return <pre>enabled: false</pre>.

template:
    name: yamlfile_value
    vars:
        filepath: '/etc/kubernetes/compliance-operator/kubeletconfig/openscap-kubeletconfig'
        yamlpath: ".kubeletconfig.authentication.anonymous.enabled"
        check_existence: "all_exist"
        values:
         - value: "false"
           operation: "equals"
