Ensure that the --read-only-port is set to 0

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

On each node (or in a kubectl debug node/$NODE_NAME shell): Run the following command on each node to find the appropriate kubeconfig value: ps -efww | grep '[k]ubelet' | grep -- '--read-only-port' The command line output should show the -read-only-port flag is set to 0. For AKS worker nodes, this audit check verifies that the kubelet --read-only-port setting is configured to 0, which disables the kubelet’s unauthenticated read-only endpoint.

조치 방법

조치 방식: 가이드 또는 인프라 패치

If the --read-only-port parameter is not set to 0, and manual modification is required, review the following file, which contains the KUBELET_FLAGS values used to build the kubelet command-line parameters. /etc/default/kubelet Before editing anything, enter debug mode and run chroot to verify what your node is actually using: kubectl debug node/$NODE_NAME -it --image=$IMAGE --profile=general chroot /host systemctl cat kubelet If the service shows an EnvironmentFile=/etc/default/kubelet and references KUBELET_FLAGS, that is the file you would edit. If it does not, then the next place to check is the kubelet systemd unit or drop-in, such as: /etc/systemd/system/kubelet.service /etc/systemd/system/kubelet.service.d/*.conf After a changing the kubelet config file, restart the kubelet service and check status.