# Ensure that the --anonymous-auth argument is set to false

- Source: https://support.icompaas.com/support/solutions/articles/62000234741-ensure-that-the-anonymous-auth-argument-is-set-to-false
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Kubernetes Benchmark v1.9.0](https://support.icompaas.com/support/solutions/62000112690) › [CIS Kubernetes Benchmark](https://support.icompaas.com/support/solutions/folders/62000169256)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 1**

**Description:**  
This check ensures that the `--anonymous-auth` argument in the Kubernetes API server configuration is set to `false`. When set to `false`, the API server does not accept anonymous requests and requires proper authentication to interact with the Kubernetes API.

**Rationale:**  
Allowing anonymous access to the Kubernetes API can lead to unauthorized access and potential security risks. Setting the `--anonymous-auth` argument to `false` helps to secure the API server by ensuring that all requests are authenticated, thereby protecting sensitive data and configuration.

**Impact:**

**Pros:**

-   Ensures that only authenticated users can access the Kubernetes API.
    
-   Reduces the risk of unauthorized access and potential misuse of the cluster.
    

**Cons:**

-   May require additional configuration for service accounts or API clients to authenticate properly.
    

**Default Value:**  
The default value for `--anonymous-auth` is typically set to `true`, meaning that anonymous requests are allowed unless explicitly disabled.

**Pre-requisites:**

-   Access to the Kubernetes API server configuration.
    
-   Proper configuration of authentication mechanisms (e.g., service accounts, certificates, etc.).
    

### **Test Plan:**

**Using AWS Console:**

1.  Open the Azure Portal and navigate to your AKS cluster settings.
    
2.  Review the API server configuration to verify that the `--anonymous-auth` argument is set to `false`.
    

**Using AWS CLI:**

Retrieve the current Kubernetes API server configuration using the following command

kubectl get cm -n kube-system kube-apiserver -o yaml

Check the argument `--anonymous-auth` to ensure it is set to `false`.

### **Implementation Plan**

**Using AWS Console:**

1.  Go to the Azure Portal.
    
2.  Under the AKS cluster settings, find the API server configuration.
    
3.  Ensure that the `--anonymous-auth` argument is set to `false`.
    

**Using AWS CLI:**

Edit the Kubernetes API server configuration using the following command:

kubectl edit deployment kube-apiserver -n kube-system

In the command section, set \--anonymous-auth=false and save the changes.  

### **Backout Plan**

**Using AWS Console:**

1.  If issues arise, revert the change in the Azure Portal by setting `--anonymous-auth` back to `true`.
    

**Using AWS CLI:**

To revert, edit the Kubernetes API server configuration:

kubectl edit deployment kube-apiserver -n kube-system

Change `--anonymous-auth` back to `true`.

**References:**

-   CIS Kubernetes Benchmark v1.7.0
    
-   Kubernetes Official Documentation

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.