For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/default_rules/def-000-c4p.md. A documentation index is available at /llms.txt.

An EKS Cluster's Kubelet's read-only port should be disabled

eks

Description

EKS worker node kubelets should disable the unauthenticated read-only port by resolving readOnlyPort to 0 in the effective kubelet configuration, so unauthenticated clients cannot retrieve potentially sensitive cluster information from the kubelet. A nonzero value such as 10255 means the read-only service is serving without authentication or authorization; an absent value commonly resolves to the disabled default of 0.

Remediation

  1. Set readOnlyPort: 0 in the effective kubelet configuration through a supported node bootstrap path — launch template user data, NodeConfig, or a custom AMI — instead of editing the kubelet config file on the host.
  2. Apply the updated launch template version to the managed node group so EKS replaces the running nodes, then re-audit the live kubelet configuration through the API server configz endpoint to confirm readOnlyPort is 0.

References