An EKS Cluster's Kubelet's read-only port should be disabled

eks
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

EKS worker node kubelets should disable the unauthenticated read-only port by resolving readOnlyPort to 0 in the effective kubelet configuration, so unauthenticated clients cannot retrieve potentially sensitive cluster information from the kubelet. A nonzero value such as 10255 means the read-only service is serving without authentication or authorization; an absent value commonly resolves to the disabled default of 0.

Remediation

  1. Set readOnlyPort: 0 in the effective kubelet configuration through a supported node bootstrap path — launch template user data, NodeConfig, or a custom AMI — instead of editing the kubelet config file on the host.
  2. Apply the updated launch template version to the managed node group so EKS replaces the running nodes, then re-audit the live kubelet configuration through the API server configz endpoint to confirm readOnlyPort is 0.

References