Ensure that the --read-only-port argument is set to 0 (Kubelet)

The Kubelet process provides a read-only API in addition to the main Kubelet API. Unauthenticated access is provided to this read-only API which could possibly retrieve potentially sensitive information about the cluster. Removal of the read-only port will require that any service which made use of it will need to be re-configured to use the main Kubelet API.

Suggest Edits

Risk Level: High
Cloud Entity: Node
CloudGuard Rule ID: D9.K8S.NET.02
Covered by Spectral: Yes
Category: Compute

GSL LOGIC

KubernetesNode where kubeletData contain-any [kubeletconfig.readOnlyPort] should not have (kubeletData.kubeletconfig.readOnlyPort != 0)

REMEDIATION

  • If using a Kubelet config file, edit the file to set readOnlyPort to 0.

  • If using command line arguments, edit the kubelet service file /etc/systemd/system/kubelet.service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.
    --read-only-port=0
    Based on your system, restart the kubelet service. For example:
    systemctl daemon-reload systemctl restart kubelet.service.

  • If using the api configz endpoint consider searching for the status of
    streamingConnectionIdleTimeout by extracting the live configuration from the nodes
    unning kubelet.
    **See detailed step-by-step configmap procedures in
    https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/

References

  1. https://kubernetes.io/docs/admin/kubelet/

Node

A node is a worker machine in Kubernetes, previously known as a minion. A node may be a VM or physical machine, depending on the cluster. Each node contains the services necessary to run pods and is managed by the master components. The services on a node include the container runtime, kubelet and kube-proxy.

Compliance Frameworks

  • CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.0.1
  • CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.1.0
  • CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.2.0
  • CIS Amazon Elastic Kubernetes Service (EKS) Benchmark v1.3.0
  • CIS Google Kubernetes Engine (GKE) Benchmark v1.2.0
  • CIS Google Kubernetes Engine (GKE) Benchmark v1.4.0
  • CIS Kubernetes Benchmark v1.20
  • CIS Kubernetes Benchmark v1.23
  • CIS Kubernetes Benchmark v1.24
  • CIS Kubernetes Benchmark v1.4.0
  • CIS Kubernetes Benchmark v1.5.1
  • CIS Kubernetes Benchmark v1.6.1
  • CIS Microsoft Kubernetes Engine (AKS) Benchmark v1.3.0
  • Kubernetes NIST.SP.800-190
  • Kubernetes v.1.13 CloudGuard Best Practices
  • Kubernetes v.1.14 CloudGuard Best Practices

Updated 7 months ago