Kubernetes STIG Version Comparison
Kubernetes Security Technical Implementation Guide
Comparison
There are 10 differences between versions v1 r3 (Oct. 27, 2021) (the "left" version) and v1 r5 (April 27, 2022) (the "right" version).
Check CNTR-K8-000320 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.
The regular view of the left check and right check may be easier to read.
Text Differences
Title
The Kubernetes API server must have the insecure port flag disabled.
Check Content
Change to the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Run the command: grep -i insecure-port * If the setting insecure-port is not set to "0" or is not configured in the Kubernetes API server manifest file, this is a finding. finding. NOTE: --insecure-port flag has been deprecated and can only be set to 0, **This flag will be removed in v1.24.*
Discussion
By default, the API server will listen on two ports. One port is the secure port and the other port is called the "localhost port". This port is also called the "insecure port", port 8080. Any requests to this port bypass authentication and authorization checks. If this port is left open, anyone who gains access to the host on which the master is running can bypass all authorization and authentication mechanisms put in place, and have full control over the entire cluster. Close the insecure port by setting the API server's --insecure-port flag to "0", ensuring that the --insecure-bind-address is not set.
Fix
Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Master Node. Set Node. Set the argument --insecure-port to "0".