Detections
Analytics

1.2.19 Ensure that the --insecure-port argument is set to 0

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Do not bind to insecure port.

Rationale:

Setting up the apiserver to serve on an insecure port would allow unauthenticated and unencrypted access to your master node. This would allow attackers who could access this port, to easily take control of the cluster.

Impact:

All components that use the API must connect via the secured port, authenticate themselves, and be authorized to use the API.

This includes:

kube-controller-manager

kube-proxy

kube-scheduler

kubelets

Solution

Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the below parameter.

--insecure-port=0

Default Value:

By default, the insecure port is set to 8080.

See Also

https://workbench.cisecurity.org/files/2968

Item Details

References: CSCv6|9.1, CSCv7|9.2

Plugin: Unix

Control ID: 09e1061b486d1de24660822fbc5a6ccfb867e0a40db5881a45576ece56368a54