Hacker News Reader

Kubernetes (and many popular distros) allowing anonymous access, even when authentication is enabled. The system:anonymous user is generally not authorized to view resources, but might be inadvertently.

To test this, if you hit the K8s API server unauthenticated, do you get a 401 error or a 403 error? If the latter, you're at risk.

View on HN

I didn't word my statement well. Yes, you can enable unauthenticated requests and you can grant the anonymous role access to the api. I didn't recall `--anonymous-auth` to be true by default.

Most of the major cloud distros (AKS being the notable exception) do have --anonymous-auth enabled, although it's generally just /version and a couple of other endpoints exposed.

Makes it easy to find out what clusters are running what versions of k8s which is interesting, but not a major security issue.

It is on certain clouds. But that isn't overtly dangerous until someone binds system:anonymous to cluster admin.

Reply on news.ycombinator.com