DISA STIGS Viewer

Finding ID	Version	Rule ID	IA Controls	Severity
V-242388	CNTR-K8-000340	SV-242388r960792_rule		High

Description

By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the "insecure bind" address and is set by default to localhost. Any requests to this address bypass authentication and authorization checks. If this insecure bind address is set to localhost, anyone who gains access to the host on which the Control Plane is running can bypass all authorization and authentication mechanisms put in place and have full control over the entire cluster. Close or set the insecure bind address by setting the API server's "--insecure-bind-address" flag to an IP or leave it unset and ensure that the "--insecure-bind-port" is not set.

STIG	Date
Kubernetes Security Technical Implementation Guide	2024-08-22

Check Text (C-45663r927082_chk)

Change to the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Run the command: grep -i insecure-bind-address * If the setting "--insecure-bind-address" is found and set to "localhost" in the Kubernetes API manifest file, this is a finding.

Fix Text (F-45621r927083_fix)

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Remove the value of "--insecure-bind-address" setting.