The --read-only-port argument is not set to 0 misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_141
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize

Impact

Disable the read-only port. The Kubelet process provides a read-only API in addition to the main Kubelet API. Unauthenticated access is provided to this read-only API which could possibly retrieve potentially sensitive information about the cluster.

How to Fix

Kind: Pod [source,go]

{ "apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kubelet tier: control-plane name: kubelet namespace: kube-system spec: containers:

• command:

• • kubelet

• • --read-only-port=0 image: gcr.io/google_containers/kubelet-amd64:v1.6.0 ...", }

---