0424-k8s-readonlyport-kubelet Verify the Read-Only Port Parameter Is Set to 0¶

Rule ID¶

• 0424-k8s-readonlyport

Category¶

• container

Severity¶

• info

Supported Versions¶

• Linux

Description¶

• Disable the read-only port

Scan Frequency¶

• 0 */30 * * *

Rationale¶

• In addition to the primary Kubelet API, the kubelet process also exposes a read-only API. This read-only API provides unauthenticated access and may be used to retrieve potentially sensitive information about the cluster.

Risk Item¶

• Container Security

Audit Method¶

• Execute the following command to verify:

  ps -ef | grep kubelet |grep read-only-port
  

Remediation¶

• The kubelet can be started in two forms: Check if a configuration file exists: /etc/systemd/system/kubelet.service.d/10-kubeadm.conf. If the file exists, set the parameter --read-only-port=0. If the file does not exist, check the kubelet startup parameter -config. Open the file, check if the parameter readOnlyPort exists, and set it to 0. After the configuration is complete, restart the kubelet:

  systemctl daemon-reload
  systemctl restart kubelet.service
  

Impact¶

• None

Default Value¶

• By default, or if not set, the system defaults to: read-only-port=10255/TCP

References¶

• kubelet

CIS Controls¶

• None