Details

Do not disable the secure port.

Rationale:

The secure port is used to serve https with authentication and authorization. If you disable it, no https traffic is served and all traffic is served unencrypted.

Solution

Edit the `/etc/kubernetes/apiserver` file on the master node and either remove the `–secure-port` argument from the `KUBE_API_ARGS` parameter or set it to a different desired port. Based on your system, restart the `kube-apiserver` service. For example: `systemctl restart kube-apiserver.service`

Impact:

You need to set the apiserver up with the right TLS certificates.

Supportive Information

The following resource is also helpful.

• https://workbench.cisecurity.org/files/1738

This security hardening control applies to the following category of controls within NIST 800-53: System and Communications Protection.This control applies to the following type of system Unix.

References

• 800-53|SC-8(1)
• CSCv6|14.2

Source

• Tenable.com/audits