kube-hunter/docs/_kb/KHV006.md

vid, title, categories

vid	title	categories
KHV006	Insecure (HTTP) access to Kubernetes API	Unauthenticated Access

{{ page.vid }} - {{ page.title }}

Issue description

The API Server port is accessible over plain HTTP, and therefore unencrypted and potentially insecured.

Remediation

Ensure your setup is exposing kube-api only on an HTTPS port.

Do not enable kube-api's --insecure-port flag in production.

References

• API Server Ports and IPs
• kube-apiserver command reference