cis-k8s-v1110-4-2-4

name	cis-k8s-v1110-4.2.4
description	Verify that if defined, readOnlyPort is set to 0 (Manual)
category	cis-k8s
version	1.11.0
author	cyberstrike-official
tags	["cis","kubernetes","worker-node","kubelet","read-only-port","api-security"]
cis_id	4.2.4
cis_benchmark	CIS Kubernetes Benchmark v1.11.0
tech_stack	["kubernetes"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

4.2.4 Verify that if defined, readOnlyPort is set to 0 (Manual)

Profile Applicability

• Level 1 - Worker Node

Description

Disable the read-only port.

Rationale

The Kubelet process provides a read-only API in addition to the main Kubelet API. Unauthenticated access is provided to this read-only API which could possibly retrieve potentially sensitive information about the cluster.

Impact

Removal of the read-only port will require that any service which made use of it will need to be re-configured to use the main Kubelet API.

Audit

Run the following command on each node:

ps -ef | grep kubelet

Verify that the --read-only-port argument exists and is set to 0. If the --read-only-port argument is not present, check that there is a Kubelet config file specified by --config. Check that if there is a readOnlyPort entry in the file, it is set to 0.

Remediation

If using a Kubelet config file, edit the file to set readOnlyPort to 0. If using command line arguments, edit the kubelet service file /etc/kubernetes/kubelet.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable.

--read-only-port=0

Based on your system, restart the kubelet service. For example:

systemctl daemon-reload
systemctl restart kubelet.service

References

1. https://kubernetes.io/docs/admin/kubelet/
2. https://github.com/kubernetes/kubernetes/blob/6cedc0853faa118df0ba3d41b48b993422ad3df6/staging/src/k8s.io/kubelet/config/v1beta1/types.go#L142

Additional Information:

https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8