The Kubernetes API server must have the insecure port flag disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254558	CNTR-R2-000120	SV-254558r870252_rule		High

Description
By default, the API server will listen on two ports. One port is the secure port and the other port is called the "localhost port". This port is also called the "insecure port", port 8080. Any requests to this port bypass authentication and authorization checks. If this port is left open, anyone who gains access to the host on which the master is running can bypass all authorization and authentication mechanisms put in place, and have full control over the entire cluster. Close the insecure port by setting the API server's --insecure-port flag to "0", ensuring that the --insecure-bind-address is not set.

Description

By default, the API server will listen on two ports. One port is the secure port and the other port is called the "localhost port". This port is also called the "insecure port", port 8080. Any requests to this port bypass authentication and authorization checks. If this port is left open, anyone who gains access to the host on which the master is running can bypass all authorization and authentication mechanisms put in place, and have full control over the entire cluster. Close the insecure port by setting the API server's --insecure-port flag to "0", ensuring that the --insecure-bind-address is not set.

STIG	Date
Rancher Government Solutions RKE2 Security Technical Implementation Guide	2022-10-13

Details

Check Text ( C-58042r870250_chk )
Ensure insecure-port is set correctly. Run this command on the RKE2 Control Plane: /bin/ps -ef \| grep kube-apiserver \| grep -v grep If --insecure-port is not set to "0" or is not configured, this is a finding.

Fix Text (F-57991r859243_fix)
Edit the /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml file --insecure-port = 0 Once configuration file is updated, restart the RKE2 Server. Run the command: systemctl restart rke2-server