API server enables DenyServiceExternalIPs admission

​

What this check verifies

Kubernetes API server with DenyServiceExternalIPs rejects net-new use of Service.spec.externalIPs and additions to that field on existing Services; existing values can only be removed.

​

Risk

Without DenyServiceExternalIPs, users with Service create/patch rights can reroute traffic via arbitrary external IPs, enabling man-in-the-middle, traffic hijacking, and data exfiltration, degrading confidentiality and integrity. Attackers may also abuse status.loadBalancer.ingress.ip to similar effect.

​

Recommendation

Enable DenyServiceExternalIPs to block net-new externalIPs usage. Apply least privilege RBAC on Services (including status updates), require change control for exposure, and favor controlled Ingress/LoadBalancer patterns. Use admission policies to tightly allow approved exceptions as defense in depth.

​

Remediation

Dashboard steps

1. SSH to the control plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. In the kube-apiserver command/args list, add: —disable-admission-plugins=DenyServiceExternalIPs
4. Save the file; the kubelet will restart the API server automatically

​

References

• https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#denyserviceexternalips
• https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#how-do-i-turn-off-an-admission-controller

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_deny_service_external_ips. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks