mirror of
https://github.com/aquasecurity/kube-hunter.git
synced 2026-08-23 22:26:23 +00:00
25 lines
695 B
Markdown
25 lines
695 B
Markdown
---
|
|
vid: KHV006
|
|
title: Insecure (HTTP) access to Kubernetes API
|
|
categories: [Unauthenticated Access]
|
|
severity: high
|
|
---
|
|
|
|
# {{ page.vid }} - {{ page.title }}
|
|
|
|
## Issue description
|
|
|
|
The API Server port is accessible over plain HTTP, and therefore unencrypted and potentially insecured.
|
|
|
|
## Remediation
|
|
|
|
Ensure your setup is exposing kube-api only on an HTTPS port.
|
|
|
|
Do not enable kube-api's `--insecure-port` flag in production.
|
|
|
|
|
|
## References
|
|
|
|
- [API Server Ports and IPs](https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/#api-server-ports-and-ips)
|
|
- [kube-apiserver command reference](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/)
|