An EKS Cluster's Kubelet's read-only port should be disabled

eks
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

EKS worker node kubelets should disable the unauthenticated read-only port by resolving readOnlyPort to 0 in the effective kubelet configuration, so unauthenticated clients cannot retrieve potentially sensitive cluster information from the kubelet. A nonzero value such as 10255 means the read-only service is serving without authentication or authorization; an absent value commonly resolves to the disabled default of 0.

Remediation

  1. Set readOnlyPort: 0 in the effective kubelet configuration through a supported node bootstrap path — launch template user data, NodeConfig, or a custom AMI — instead of editing the kubelet config file on the host.
  2. Apply the updated launch template version to the managed node group so EKS replaces the running nodes, then re-audit the live kubelet configuration through the API server configz endpoint to confirm readOnlyPort is 0.

References