Kubelet read-only port is disabled (set to 0)

​

What this check verifies

Kubernetes Kubelet configuration is inspected for the readOnlyPort setting and whether it is set to 0 to disable the unauthenticated HTTP endpoint.

​

Risk

An open kubelet read-only port allows unauthenticated queries to node and pod metadata and metrics, causing information disclosure. Attackers can map workloads, discover endpoints, and prepare lateral movement, undermining confidentiality and enabling targeted exploitation of weak configurations.

​

Recommendation

Disable the unauthenticated endpoint by setting readOnlyPort: 0. Apply least privilege: expose only the TLS-authenticated kubelet endpoint, enforce authorization, and restrict network access to kubelet with host firewalls or network policies. Monitor nodes for unexpected open ports.

​

Remediation

Dashboard steps

1. Edit the kubelet configuration ConfigMap: run kubectl -n kube-system edit configmap/<example_resource_name> (e.g., kubelet-config-1.xx)
2. In the data entry that contains the KubeletConfiguration YAML, add or set this top-level line:
   readOnlyPort: 0
   
3. Save and exit
4. Restart kubelet on each node to apply:
   sudo systemctl restart kubelet
   

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_disable_read_only_port. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks