Securing Kubelet Endpoints: Fine-Grained Authz Reaches GA

Kubernetes v1.36 marks a pivotal security milestone with the General Availability (GA) promotion of Fine-Grained Kubelet API Authorization (KubeletFineGrainedAuthz). For years, enterprise platform teams and infrastructure architects operated under an uncomfortable compromise: to collect essential node metrics, container statistics, and hardware specifications, observability daemons required the overly permissive nodes/proxy ClusterRole permission. This legacy requirement granted third-party agents and internal telemetry pipelines sweeping proxy capabilities across worker node Kubelet HTTPS endpoints.

By locking KubeletFineGrainedAuthz to enabled in Kubernetes v1.36, the project officially deprecates this high-risk pattern. Engineering leaders, CTOs, and CISOs can now enforce rigorous least-privilege access across worker node Kubelets. The feature decomposes monolithic proxy access into distinct, subresource-level RBAC verb-path bindings. Consequently, telemetry tools no longer require permissions that could be weaponized to stream logs, attach to running containers, or establish interactive WebSocket proxy sessions directly onto cluster hosts.

Business & Operational Impact

The business rationale for adopting fine-grained Kubelet authorization centers on blast-radius reduction and regulatory compliance. Historically, an attacker compromising a monitoring agent possessing nodes/proxy rights could leverage the API server proxy mechanism to issue arbitrary requests directly to worker node Kubelets. This attack vector permitted arbitrary command execution inside pods, host filesystem traversal, and node takeover—bypassing traditional network firewalls and pod security standards.

From a risk management perspective, eliminating mandatory nodes/proxy grants resolves a major audit finding for organizations operating under SOC 2 Type II, ISO 27001, PCI-DSS, or FedRAMP frameworks. Compliance standards explicitly mandate least-privilege access control for telemetry and auditing agents. By mapping observability daemons exclusively to subresources like /metrics or /stats, enterprise security teams can demonstrate strict separation of operational concerns.

Furthermore, this shift reduces operational friction between security operations (SecOps) and site reliability engineering (SRE) teams. Platform engineers no longer need to request high-risk security exceptions to deploy standard monitoring stacks like Prometheus, Datadog, or OpenTelemetry Collectors. The result is an accelerated deployment cadence for platform services alongside a significantly hardened runtime posture.

Architectural & Engineering Blueprint

Architecturally, the Kubelet API exposes multiple HTTPS endpoints on port 10250, including /metrics, /metrics/cadvisor, /stats, /spec, /exec, /attach, and /logs. Prior to fine-grained authorization, RBAC rules could not granularly differentiate between a benign read request to /metrics and an interactive request to /exec.

With KubeletFineGrainedAuthz active in v1.36, the Kubelet delegates authorization decisions to the Kubernetes API server using SubjectAccessReview requests that include detailed request paths and subresources. Instead of granting blanket proxy rights, platform teams create targeted ClusterRole objects bound to specific Kubelet subresources.

Consider the operational transition. Under the legacy model, a Prometheus scraper required the following insecure configuration:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-kubelet-legacy
rules:
- apiGroups: [""]
  resources: ["nodes/proxy"]
  verbs: ["get", "list", "watch"]

Under the v1.36 GA implementation, this ClusterRole is restructured to isolate exact subresource paths:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: prometheus-kubelet-v136
rules:
- apiGroups: [""]
  resources:
  - "nodes/metrics"
  - "nodes/stats"
  - "nodes/spec"
  verbs: ["get"]

When an observability pod issues an HTTP request to https://<node-ip>:10250/metrics, the Kubelet verifies the client certificate or bearer token via Webhook authentication and executes a SubjectAccessReview against the API server. The API server evaluates whether the ServiceAccount holds explicit get permissions on nodes/metrics. If authorization fails, the Kubelet responds with HTTP 403 Forbidden, insulating /exec and /attach endpoints from unauthorized invocation.

What This Changes in Practice

• Audit Legacy ClusterRoles Immediately: Inspect all existing ServiceAccounts and ClusterRoles across workloads, Helm charts, and daemonsets to identify legacy references to nodes/proxy.
• Refactor Monitoring Manifests: Update OpenTelemetry, Prometheus, Fluentbit, and third-party security agent manifests to request subresource-specific RBAC rules (nodes/metrics, nodes/stats, nodes/spec).
• Eliminate Lateral Escalation Vectors: Ensure service accounts tied to monitoring daemons cannot be exploited to execute remote commands or open WebSocket proxy tunnels onto cluster worker nodes.
• Update CI/CD Policy Enforcers: Integrate OPA/Gatekeeper or Kyverno policies that flag or block ClusterRoles granting nodes/proxy permissions in new deployments.
• Verify Webhook Authorization Latency: Monitor API server performance metrics, ensuring Webhook SubjectAccessReview evaluations between Kubelet and API server do not introduce scraping timeouts during peak metric bursts.

How Ali Run AIOps Approaches This

At Ali Run AIOps, we embed secure-by-design principles directly into cloud-native architectures, enterprise Kubernetes migrations, and automated SRE workflows. Our engineering practice systematically audits cluster RBAC topologies, identifying over-permissioned service accounts and replacing monolithic proxy grants with fine-grained subresource policies tailored for modern Kubernetes environments.

Through our specialized consulting and AIOps platform integrations, we ensure telemetry pipelines, security agents, and infrastructure monitoring run under strict least-privilege models. By combining automated RBAC drift detection with continuous compliance enforcement, Ali Run AIOps empowers engineering organizations to maintain uncompromised cluster visibility while adhering to strict zero-trust standards.

Sources

• Kubernetes v1.36: Fine-Grained Kubelet API Authorization Graduates to GA
• Platform Engineering Monthly — April 2026