The Kubernetes API server must have the secure port set.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-242389 | CNTR-K8-000350 | SV-242389r960792_rule | CCI-000213 | medium |
| Description | ||||
| By default, the API server will listen on what is rightfully called the secure port, port 6443. Any requests to this port will perform authentication and authorization checks. If this port is disabled, anyone who gains access to the host on which the Control Plane is running has full control of the entire cluster over encrypted traffic. Open the secure port by setting the API server's "--secure-port" flag to a value other than "0". | ||||
| STIG | Date | |||
| Kubernetes Security Technical Implementation Guide | 2025-05-16 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-3
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.1.1
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.1.2
1.00
- DISA · 2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000213
1.00
- DISA · 2 · disa_xccdf · related
Details
Check Text (C-242389r960792_chk)
Change to the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Run the command:
grep -i secure-port *
If the setting "--secure-port" is set to "0" or is not configured in the Kubernetes API manifest file, this is a finding.
Fix Text (F-45622r927086_fix)
Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane.
Set the value of "--secure-port" to a value greater than "0".