VIEW RULE IN DATADOG VIEW MISCONFIGURATIONS

Description

EKS worker node kubelets should disable the unauthenticated read-only port by resolving readOnlyPort to 0 in the effective kubelet configuration, so unauthenticated clients cannot retrieve potentially sensitive cluster information from the kubelet. A nonzero value such as 10255 means the read-only service is serving without authentication or authorization; an absent value commonly resolves to the disabled default of 0.

Remediation

1. Set readOnlyPort: 0 in the effective kubelet configuration through a supported node bootstrap path — launch template user data, NodeConfig, or a custom AMI — instead of editing the kubelet config file on the host.
2. Apply the updated launch template version to the managed node group so EKS replaces the running nodes, then re-audit the live kubelet configuration through the API server configz endpoint to confirm readOnlyPort is 0.

References

• Amazon EKS managed node groups
• Kubelet configuration (v1beta1)
• CIS Amazon EKS Benchmark