V-242387—The Kubernetes Kubelet must have the "readOnlyPort" flag disabled.
CAT I - High
CNTR-K8-000330
>Control Description
Kubelet serves a small REST API with read access to port 10255. The read-only port for Kubernetes provides no authentication or authorization security control. Providing unrestricted access on port 10255 exposes Kubernetes pods and containers to malicious attacks or compromise. Port 10255 is deprecated and should be disabled.
>Check Content
On each Control Plane and Worker Node,
$ps -ef | grep kubeletIf the "--read-only-port" option exists, this is a finding. Note the path to the config file (identified by --config).
$grep -i readOnlyPort <path_to_config_file>If the setting "readOnlyPort" exists and is not set to "0", this is a finding.
>Remediation
On each Control Plane and Worker Node,
$ps -ef | grep kubeletRemove the "--read-only-port" option if present. Note the path to the config file (identified by --config). Edit the config file: Set "readOnlyPort" to "0" or remove the setting. Restart the kubelet service
$systemctl daemon-reload && systemctl restart kubelet>CCI References
Control Correlation Identifiers (CCIs) map STIG findings to NIST 800-53 controls.
>Cross-Framework Mappings
NIST SP 800-53 r5
via DISA CCI ListAsk AI
Configure your API key to use AI features.