> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubelet Anonymous Auth Set To False

### More Info:

Anonymous authentication should be disabled on the kubelet so that unauthenticated requests are rejected. Enabling it allows anonymous, unauthenticated access to the kubelet API.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* CIS AKS

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every worker node, open the kubelet config file and ensure anonymous auth is disabled:

        ```bash theme={null}
        sudo vi /var/lib/kubelet/config.yaml
        ```

        Find (or add if missing) the following section and set it exactly like this:

        ```yaml theme={null}
        authentication:
          anonymous:
            enabled: false
        ```

        Save and exit.

        2. If the kubelet is also configured via systemd flags, ensure no conflicting `--anonymous-auth` flag is present:

        ```bash theme={null}
        sudo grep -R -- '--anonymous-auth' /etc/systemd/system /usr/lib/systemd/system || echo "no kubelet anonymous-auth flag found"
        ```

        If you see a kubelet unit drop-in with `--anonymous-auth=true`, edit it:

        ```bash theme={null}
        sudo vi /etc/systemd/system/kubelet.service.d/10-kubeadm.conf
        ```

        In the line that defines kubelet arguments, set or add:

        ```text theme={null}
        --anonymous-auth=false
        ```

        Save and exit.

        3. Reload systemd and restart kubelet on that worker node:

        ```bash theme={null}
        sudo systemctl daemon-reload
        sudo systemctl restart kubelet.service
        ```

        4. Verify the kubelet process is running with anonymous auth disabled on that worker node:

        ```bash theme={null}
        /bin/ps -fC kubelet
        ```

        Check the output for either `--anonymous-auth=false` or confirm there is no `--anonymous-auth=true` flag and anonymous auth is disabled via `/var/lib/kubelet/config.yaml` as edited in step 1.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot change kubelet process flags or its config file, so this finding cannot be remediated via the Kubernetes API. The fix must be applied directly on each worker node’s host configuration (for example `/var/lib/kubelet/config.yaml` and the kubelet systemd unit); see the Manual Steps section for details.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Disable kubelet anonymous authentication via /var/lib/kubelet/config.yaml
        # Applies to: every worker node
        # Usage: run as root on each worker node (safe to re-run)

        set -euo pipefail

        KUBELET_CONFIG="/var/lib/kubelet/config.yaml"
        SYSTEMD_UNIT="kubelet.service"

        echo "[INFO] Ensuring kubelet anonymous-auth is disabled using ${KUBELET_CONFIG}"

        if [[ ! -f "${KUBELET_CONFIG}" ]]; then
          echo "[ERROR] ${KUBELET_CONFIG} not found. This script assumes kubelet uses a config file."
          echo "[ERROR] If kubelet is configured only via flags, adjust /etc/systemd/system/kubelet.service.d/10-kubeadm.conf manually."
          exit 1
        fi

        # Ensure yq is available (for safe YAML edits); install instructions are environment-specific
        if ! command -v yq >/dev/null 2>&1; then
          echo "[ERROR] 'yq' is required but not installed. Install yq v4+ and re-run."
          exit 1
        fi

        echo "[INFO] Backing up existing kubelet config to ${KUBELET_CONFIG}.bak-$(date +%Y%m%d%H%M%S)"
        cp "${KUBELET_CONFIG}" "${KUBELET_CONFIG}.bak-$(date +%Y%m%d%H%M%S)"

        # Idempotently set authentication.anonymous.enabled = false
        TMP_FILE="$(mktemp)"
        yq '.authentication.anonymous.enabled = false' "${KUBELET_CONFIG}" > "${TMP_FILE}"
        mv "${TMP_FILE}" "${KUBELET_CONFIG}"

        echo "[INFO] Reloading systemd and restarting kubelet (this will restart the kubelet)"
        systemctl daemon-reload
        systemctl restart "${SYSTEMD_UNIT}"

        echo "[INFO] Waiting for kubelet to be active..."
        systemctl is-active --quiet "${SYSTEMD_UNIT}"
        echo "[INFO] kubelet is active"

        echo "[INFO] Verifying kubelet anonymous-auth is disabled in config..."
        yq '.authentication.anonymous.enabled' "${KUBELET_CONFIG}"

        echo "[INFO] Verifying running kubelet process and looking for any conflicting --anonymous-auth flags..."
        /bin/ps -fC kubelet || true

        echo "[INFO] If any --anonymous-auth=true flag appears in the process output above, remove it from:"
        echo "       /etc/systemd/system/kubelet.service.d/10-kubeadm.conf and restart kubelet again."
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>