Ensure the kubelet read-only port is disabled

ÉlevéeNiveau 1Revue manuelleoke

Description

In OKE, this setting is intended to keep kubelet access limited to the standard secured management path used for node operations, instead of exposing an additional legacy interface on the worker node. In practice, it should be assessed in the node’s effective kubelet configuration because OKE applies managed node behavior through cloud-init initialization, node pool configuration, and worker node replacement workflows rather than relying only on ... The benchmark marks this recommendation Manual.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

To audit whether the kubelet read-only port is disabled on an OKE worker node, query the live effective kubelet configuration through the Kubernetes API server proxy and inspect the kubelet configz output for readOnlyPort set to 0. Kubernetes identifies configz as the view of the kubelet’s final actuated configuration, and the kubelet configuration schema defines readOnlyPort as the setting that controls the unauthenticated read-only kubelet service.

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

If the audit returns a nonzero readOnlyPort``, the worker node is exposing the kubelet read-only service and should be treated as noncompliant. If the field is missing from configz, first confirm whether it is simply omitted because the effective value is 0, since the kubelet configuration schema defines readOnlyPortas the unauthenticated read-only service and states that0` disables it. Once a noncompliant state is confirmed, remediation in OKE should be performed through the supported managed node initialization, node pool update, or node replacement workflow, not by directly editing the kubelet config file on the host. Oracle documents that OKE managed nodes use cloud-init initialization scripts, that custom logic can be added without modifying the default OKE initialization logic, and that updated worker node properties are applied by starting replacement worker nodes.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: okeworker-nodekubelet
Référence: CIS Oracle Cloud Infrastructure Container Engine for Kubernetes (OKE) Benchmark v2.0.0 - 3.2.4 Ensure the kubelet read-only port is disabled