Title

The Kubernetes API server must have the secure port set. (Cat II impact)

Discussion

By default, the API server will listen on what is rightfully called the secure port, port 6443. Any requests to this port will perform authentication and authorization checks. If this port is disabled, anyone who gains access to the host on which the Control Plane is running has full control of the entire cluster over encrypted traffic. Open the secure port by setting the API server's --secure-port flag to a value other than "0".

Check Content

Change to the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Run the command: grep -i secure-port * If the setting secure-port is set to "0" or is not configured in the Kubernetes API manifest file, this is a finding.

Fix Text

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Set the argument --secure-port to a value greater than "0".

Additional Identifiers

Rule ID: SV-242389r879530_rule

Vulnerability ID: V-242389

Group Title: SRG-APP-000033-CTR-000100

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.