Details

Use https for kubelet connections.

Rationale:

Connections from apiserver to kubelets could potentially carry sensitive data such as secrets and keys. It is thus important to use in-transit encryption for any communication between the apiserver and kubelets.

Solution

Edit the API server pod specification file ‘/etc/kubernetes/manifests/kube-apiserver.yaml’ on the master node and remove the ‘–kubelet-https’ parameter.

Impact:

You require TLS to be configured on apiserver as well as kubelets.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/1788

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-8(1)
• CSCv6|14.2

Source

• Tenable.com/audits