Detections
Analytics

4.2.5 Verify that the read only port is not used or is set to 0

Information

Disable the read-only port.

The Kubelet process provides a read-only API in addition to the main Kubelet API. Unauthenticated access is provided to this read-only API which could possibly retrieve potentially sensitive information about the cluster.

Solution

In earlier versions of OpenShift 4, the read-only-port argument is not used.

Follow the instructions in the documentation https://docs.openshift.com/container-platform/latest/post_installation_configuration/machine-configuration-tasks.html#create-a-kubeletconfig-crd-to-edit-kubelet-parameters_post-install-machine-configuration-tasks to create a kubeletconfig CRD and set the kubelet-read-only-port is set to 0.

Impact:

Removal of the read-only port will require that any service which made use of it will need to be re-configured to use the main Kubelet API.

See Also

https://workbench.cisecurity.org/benchmarks/24114

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: OpenShift

Control ID: 4365f101726d128708be76278bc0b490ac7d1080aa4119eeebcbd53f78b93551