(in versions v1 r6 through v1 r1)
The Kubernetes API server must have the secure port set. (Cat II impact)
By default, the API server will listen on what is rightfully called the secure port, port 6443. Any requests to this port will perform authentication and authorization checks. If this port is disabled, anyone who gains access to the host on which the master is running has full control of the entire cluster over encrypted traffic. Open the secure port by setting the API server's --secure-port flag to a value other than "0".
Change to the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Run the command: grep -i secure-port * If the setting secure-port is set to "0" or is not configured in the Kubernetes API manifest file, this is a finding.
Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Set the argument --secure-port to a value greater than "0".
Rule ID: SV-242389r712523_rule
Vulnerability ID: V-242389
Group Title: SRG-APP-000033-CTR-000100
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.