Hands-on Lab·Kubernetes and Cloud Native Security Associate
Kubelet API Access and Ports
Every node runs an API that can list Pods, read logs and exec into containers - and it is not the apiserver. This guide reads the kubelet's authentication and authorization settings, then calls it from outside with no credential.
Cluster Component Security Guide 12 of 42 Intermediate
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 16 min
kubeadm's kubelet defaults for v1.36, in /var/lib/kubelet/config.yaml. readOnlyPort defaults to 0 and kubeadm does not set it, which is why port 10255 is not listening here.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a security review stops at the API server. This matters because every node runs a second API that can list Pods, read logs and exec into containers - with its own authentication settings, which inherit from nowhere.
- reading the kubelet's own authentication and authorization settings
- finding what is listening, and on which interface
- calling the kubelet API with nothing at all, and then the read-only port that is not there
Before you start
- guide 10 - the other API, for comparison.
-
Its authentication and authorization, which are its own
-
What is listening, and on which interface
-
Calling it with nothing