How do I install the Cis K8S V1120 1.2.7 skill?

Run npx skillmds@latest add cyberstrikeus/cis-k8s-v1120-1-2-7 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis K8S V1120 1.2.7 skill do?

Ensure that the --authorization-mode argument includes Node (Automated) It is listed under DevOps & Infra on SkillMD.

Is Cis K8S V1120 1.2.7 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis K8S V1120 1.2.7?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis K8S V1120 1.2.7 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis K8S V1120 1.2.7?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis K8S V1120 1.2.7 by cyberstrikeus

Name: Cis K8S V1120 1.2.7
Author: cyberstrikeus

File contents

1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)

Profile Applicability

Level 1 - Master Node

Description

Restrict kubelet nodes to reading only objects associated with them.

Rationale

The Node authorization mode only allows kubelets to read Secret, ConfigMap, PersistentVolume, and PersistentVolumeClaim objects associated with their nodes.

Impact

None

Audit

Run the following command on the Control Plane node:

ps -ef | grep kube-apiserver

Verify that the --authorization-mode argument exists and is set to a value to include Node.

Remediation

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the Control Plane node and set the --authorization-mode parameter to a value that includes Node.

--authorization-mode=Node,RBAC

Default Value

By default, Node authorization is not enabled.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	3.3 Configure Data Access Control Lists	*	*	*
v7	9.2 Ensure Only Approved Ports, Protocols and Services Are Running		*	*

---name: cis-k8s-v1120-1-2-7description: Ensure that the --authorization-mode argument includes Node (Automated)---# 1.2.7 Ensure that the --authorization-mode argument includes Node (Automated)## Profile Applicability- Level 1 - Master Node## DescriptionRestrict kubelet nodes to reading only objects associated with them.## RationaleThe `Node` authorization mode only allows kubelets to read `Secret`, `ConfigMap`, `PersistentVolume`, and `PersistentVolumeClaim` objects associated with their nodes.## ImpactNone## AuditRun the following command on the Control Plane node:```bashps -ef | grep kube-apiserver```Verify that the `--authorization-mode` argument exists and is set to a value to include `Node`.## RemediationEdit the API server pod specification file `/etc/kubernetes/manifests/kube-apiserver.yaml` on the Control Plane node and set the `--authorization-mode` parameter to a value that includes `Node`.```--authorization-mode=Node,RBAC```## Default ValueBy default, `Node` authorization is not enabled.## References1. [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)2. [https://kubernetes.io/docs/admin/authorization/node/](https://kubernetes.io/docs/admin/authorization/node/)3. [https://github.com/kubernetes/kubernetes/pull/46076](https://github.com/kubernetes/kubernetes/pull/46076)4. [https://acotten.com/post/kube17-security](https://acotten.com/post/kube17-security)## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ------------------------------------------------------------------ | ---- | ---- | ---- || v8 | 3.3 Configure Data Access Control Lists | \* | \* | \* || v7 | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running | | \* | \* |

Frequently asked questions

Cis K8S V1120 1.2.7