Back to Checks
alibabacloud

Kubernetes web UI (Dashboard) is disabled on Kubernetes Engine clusters

cs_kubernetes_dashboard_disabled
Service: csSeverity: high
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:ALIYUN::CS::ManagedKubernetesCluster

Alibaba Cloud Kubernetes Engine clusters should not have the Kubernetes Dashboard (web UI) enabled. The Dashboard uses a highly privileged Service Account that can perform administrative operations across the cluster. Use the ACK Console instead, which provides fine-grained access control through RAM policies and RBAC integration.

Prowler logoProwlerprowler-provider-alibabacloud

Risk

The Kubernetes Dashboard uses a highly privileged Service Account with broad cluster access. If compromised through a vulnerability or unauthorized access, an attacker could gain full control over the cluster, deploy malicious workloads, exfiltrate secrets, and escalate privileges, impacting confidentiality, integrity, and availability of all workloads and data.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler alibabacloud --checks cs_kubernetes_dashboard_disabled

Recommendation

Delete the Kubernetes Dashboard deployment from the kube-system namespace using kubectl or the ACK Console. Use the ACK Console for cluster management instead of the Kubernetes Dashboard.

Remediation

CLI

kubectl delete deployment kubernetes-dashboard -n kube-system

Other

1Log on to the **ACK Console**.
2Select the target cluster and select the `kube-system` namespace in the Namespace pop-menu.
3Input `dashboard` in the deploy filter bar.
4Make sure there is no result after the filter.
5If dashboard exists, delete the deployment by selecting **Delete** in the More pop-menu.

Check Code

from prowler.lib.check.models import Check, CheckReportAlibabaCloud
from prowler.providers.alibabacloud.services.cs.cs_client import cs_client


class cs_kubernetes_dashboard_disabled(Check):
    """Check if Kubernetes web UI / Dashboard is disabled."""

    def execute(self) -> list[CheckReportAlibabaCloud]:
        findings = []

        for cluster in cs_client.clusters:
            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=cluster)
            report.region = cluster.region
            report.resource_id = cluster.id
            report.resource_arn = f"acs:cs:{cluster.region}:{cs_client.audited_account}:cluster/{cluster.id}"

            if not cluster.dashboard_enabled:
                report.status = "PASS"
                report.status_extended = f"Kubernetes cluster {cluster.name} does not have the Kubernetes Dashboard enabled."
            else:
                report.status = "FAIL"
                report.status_extended = f"Kubernetes cluster {cluster.name} has the Kubernetes Dashboard enabled."

            findings.append(report)

        return findings

References