OpenControls Logo

STIG Viewer

The Kubernetes API server must have the insecure port flag disabled.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-242386CNTR-K8-000320SV-242386r960792_ruleCCI-000213high
Description
By default, the API server will listen on two ports. One port is the secure port and the other port is called the "localhost port". This port is also called the "insecure port", port 8080. Any requests to this port bypass authentication and authorization checks. If this port is left open, anyone who gains access to the host on which the Control Plane is running can bypass all authorization and authentication mechanisms put in place, and have full control over the entire cluster. Close the insecure port by setting the API server's "--insecure-port" flag to "0", ensuring that the "--insecure-bind-address" is not set.
STIGDate
Kubernetes Security Technical Implementation Guide2025-05-16

Related Frameworks

4 paths across 3 frameworks
NIST 800-531 mapping
AC-3
1.00
  • DISA · 2 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.1.1
1.00
  • DISA · 2 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
  • NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.1.2
1.00
  • DISA · 2 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
  • NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000213
1.00
  • DISA · 2 · disa_xccdf · related

Details

Check Text (C-242386r960792_chk)

Change to the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Run the command: grep -i insecure-port * If the setting "--insecure-port" is not set to "0" or is not configured in the Kubernetes API server manifest file, this is a finding. Note: "--insecure-port" flag has been deprecated and can only be set to "0". **This flag will be removed in v1.24.*

Fix Text (F-45619r927080_fix)

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Set the value of "--insecure-port" to "0".