<h2>Let's start with some context:</h2>
<p>I'm studying CKS and reading CIS_Kubernetes_Benchmark_v1.6.0.pdf and there's a confusing section:</p>
<pre><code>1.2.17 Ensure that the admission control plugin NodeRestriction is set (Automated) 

...
Verify that the --enable-admission-plugins argument is set to a value that includes 
NodeRestriction. 
  
Remediation: 
Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets. 
Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-
apiserver.yaml on the master node and set the --enable-admission-plugins parameter 
to a value that includes NodeRestriction.
</code></pre>
<p>The part about check if <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> has an entry for - <code>--enable-admission-plugins=NodeRestriction</code>,... makes sense, the annoying part is<br />
<code>&quot;Follow the Kubernetes documentation and configure NodeRestriction plug-in on kubelets.&quot;</code><br />
Is extremely hard to google, and the Kubernetes official docs aren't clear about how to do this.</p>
<h2>So now that the context is there the question is:</h2>
<p>After setting - <code>--enable-admission-plugins=NodeRestriction</code> on the kube-apiserver, how do you verify that the NodeRestriction plug-in on the kubelet has been correctly configured?</p>

neoakris
<p>To properly enable NodeRestrictions Admission Controller Plugin, you actually need to update kubernetes configuration in 3 different places:</p>
<ol>
<li>kube-apiserver: - <code>--enable-admission-plugins=NodeRestriction,...</code></li>
<li>kube-apiserver: - <code>--authorization-mode=Node,RBAC</code>   (You must have Node specified)</li>
<li>kubelet (of every node): <code>/var/lib/kubelet/config.yaml</code>  should have <code>authorization.mode: Webhook</code> (Other kubernetes distributions may substitute <code>/var/lib/kubelet/config.yaml</code> with another method of configuring it, but I'm sure there'd be a matching value)</li>
</ol>
<p>When kubelet's authorization.mode is set to Webhook, instead of it's default of <code>AlwaysAllow</code>, it offloads authorization decisions to the kubernetes api-server. The Node Authorization mode is a special-purpose authorization mode that specifically authorizes API requests made by kubelet.</p>
<p>(The giantswarm article below is a great read, and does a good job explaining why you should implement this setting, I'll try to summarize it by saying that's generic hardening that helps prevent privilege escalation by a compromised workload or bad actor.)</p>
<p>Sources:<br />
1.) <a href="https://training.linuxfoundation.org/training/kubernetes-security-essentials-lfs260/" rel="nofollow noreferrer">Kubernetes Security Essentials (LFS260)</a><br />
2.) <a href="https://www.giantswarm.io/blog/securing-the-configuration-of-kubernetes-cluster-components" rel="nofollow noreferrer">Securing the Configuration of Kubernetes Cluster Components</a><br />
3.) <a href="https://kubernetes.io/docs/reference/access-authn-authz/node/" rel="nofollow noreferrer">Using Node Authorization</a></p>
