Details

By default, the API server will listen on what is rightfully called the secure port, port 6443. Any requests to this port will perform authentication and authorization checks. If this port is disabled, anyone who gains access to the host on which the master is running has full control of the entire cluster over encrypted traffic.

Open the secure port by setting the API server’s –secure-port flag to a value other than ‘0’.

Solution

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the argument –secure-port to a value greater than ‘0’.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Kubernetes_V1R4_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.

References

• 800-53|AC-3
• CAT|II
• CCI|CCI-000213
• Rule-ID|SV-242389r712523_rule
• STIG-ID|CNTR-K8-000350
• Vuln-ID|V-242389

Source

• Tenable.com/audits