Back to Checks
kubernetes

Kubelet read-only port is disabled (set to 0)

kubelet_disable_read_only_port
Service: kubeletSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-securitynode-security
Resource Type:ConfigMap

Kubernetes Kubelet configuration is inspected for the readOnlyPort setting and whether it is set to 0 to disable the unauthenticated HTTP endpoint.

Prowler logoProwlerprowler-provider-kubernetes

Risk

An open kubelet read-only port allows unauthenticated queries to node and pod metadata and metrics, causing information disclosure. Attackers can map workloads, discover endpoints, and prepare lateral movement, undermining confidentiality and enabling targeted exploitation of weak configurations.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks kubelet_disable_read_only_port

Recommendation

Disable the unauthenticated endpoint by setting readOnlyPort: 0.

Apply least privilege: expose only the TLS-authenticated kubelet endpoint, enforce authorization, and restrict network access to kubelet with host firewalls or network policies. Monitor nodes for unexpected open ports.

Remediation

Other

1Edit the kubelet configuration ConfigMap: run `kubectl -n kube-system edit configmap/<example_resource_name>` (e.g., kubelet-config-1.xx)
2In the data entry that contains the KubeletConfiguration YAML, add or set this top-level line:
3```
4readOnlyPort: 0
5```
6Save and exit
7Restart kubelet on each node to apply:
8```
9sudo systemctl restart kubelet
10```

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.kubelet.kubelet_client import kubelet_client


class kubelet_disable_read_only_port(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for cm in kubelet_client.kubelet_config_maps:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=cm)
            if "readOnlyPort" not in cm.kubelet_args:
                report.status = "MANUAL"
                report.status_extended = f"Kubelet does not have the argument `readOnlyPort` in config file {cm.name}, verify it in the node's arguments."
            else:
                if cm.kubelet_args["readOnlyPort"] == 0:
                    report.status = "PASS"
                    report.status_extended = f"Kubelet has the read-only port disabled in config file {cm.name}."
                else:
                    report.status = "FAIL"
                    report.status_extended = f"Kubelet has the read-only port enabled in config file {cm.name}."
            findings.append(report)
        return findings

References