kubelet - Disable the Read-Only Port
An XCCDF Rule
Description
To disable the read-only port, edit the kubelet configuration
Edit the openshift-kube-apiserver configmap
and set the kubelet-read-only-port parameter to 0:
"apiServerArguments":{
...
"kubelet-read-only-port":[
"0"
],
...
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
-
{{if ne .hypershift_cluster "None"}}/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config{{else}}/api/v1/namespaces/openshift-kube-apiserver/configmaps/config{{end}}API endpoint, filter with with thejqutility using the following filter{{if ne .hypershift_cluster "None"}}.data."config.json" | fromjson{{else}}.data."config.yaml" | fromjson{{end}}and persist it to the local
Rationale
OpenShift disables the read-only port (10255) on all nodes by setting the
read-only port kubelet flag to 0. This ensures only
authenticated connections are able to receive information about the OpenShift
system.
- ID
- xccdf_org.ssgproject.content_rule_kubelet_disable_readonly_port
- Severity
- Medium
- References
- Updated