The Kubernetes API server must have the insecure bind address not set.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254560	CNTR-R2-000140	SV-254560r859250_rule		High

Description

By default, the API server will listen on two ports and addresses. One address is the secure address and the other address is called the "insecure bind" address and is set by default to localhost. Any requests to this address bypass authentication and authorization checks. If this insecure bind address is set to localhost, anyone who gains access to the host on which the master is running can bypass all authorization and authentication mechanisms put in place and have full control over the entire cluster. Close or set the insecure bind address by setting the API server's --insecure-bind-address flag to an IP or leave it unset and ensure that the --insecure-bind-port is not set.

STIG	Date
Rancher Government Solutions RKE2 Security Technical Implementation Guide	2022-10-13

Details

Check Text ( C-58044r859248_chk )
Ensure insecure-bind-address is set correctly. Run the command: ps -ef | grep kube-apiserver If the setting insecure-bind-address is found and set to "localhost" in the Kubernetes API manifest file, this is a finding.

Fix Text (F-57993r859249_fix)
Edit the /var/lib/rancher/rke2/agent/pod-manifests/kube-apiserver.yaml on the Kubernetes RKE2 Control Plane. Remove the value for the --insecure-bind-address setting. Once configuration file is updated, restart the RKE2 Server. Run the command: systemctl restart rke2-server