# Ensure that the read-only-port is Disabled

- Source: https://support.icompaas.com/support/solutions/articles/62000234183-ensure-that-the-read-only-port-is-disabled-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Amazon EKS](https://support.icompaas.com/support/solutions/62000112685) › [CIS Amazon Elastic Kubernetes Service (EKS) Benchmark](https://support.icompaas.com/support/solutions/folders/62000169234)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:** **• Level 1**

**Description:** Disable the Kubelet’s read-only port to prevent unauthenticated access to potentially sensitive information about the cluster.

**Rationale:** The Kubelet exposes a read-only API that could be accessed without authentication, allowing attackers to retrieve potentially sensitive data. Disabling the read-only port helps mitigate the risk of exposure, ensuring that only authenticated requests can interact with the Kubelet.

**Impact:  
 Pros:**

-   Prevents unauthorized access to Kubelet data through the read-only port.
    
-   Improves the security posture of the Kubernetes cluster by ensuring all API interactions are authenticated.
    

**Cons:**

-   Any services relying on the read-only port will need to be reconfigured to use the main Kubelet API.
    

Default Value:  
 By default, the --read-only-port may be enabled, allowing unauthenticated access. This needs to be disabled for enhanced security.

**Pre-requisites:**

-   SSH or Session Manager access to the worker nodes.
    
-   Permissions to modify Kubelet configuration files or service arguments.
    
-   Kubernetes access to verify changes.
    

### **Remediation**

**Test Plan:**

**Using AWS Console:**

1.  Navigate to Amazon EC2 > Instances, and connect to each worker node using Session Manager or EC2 Instance Connect.
    
2.  Run the following command to find the Kubelet process:  
    ps -ef | grep kubelet
    

3.  Identify the configuration file path from the command output (look for --config).
    
4.  Open the Kubelet configuration file using:  
    cat /etc/kubernetes/kubelet/kubelet-config.json
    

5.  Confirm the --read-only-port argument is set to 0.
    
    -   If not present, check the readOnlyPort entry in the file and ensure it is set to 0.
        

**Using AWS CLI:**

1.  Get the list of nodes in your cluster:  
    
    kubectl get nodes
    

2.  Start a proxy for the Kubernetes API:  
    
    kubectl proxy --port=8080
    

3.  In a new terminal, for each node, run:  
    
    export NODE\_NAME=my-node-name
    curl http://localhost:8080/api/v1/nodes/${NODE\_NAME}/proxy/configz
    

4.  Verify that the readOnlyPort is set to 0 in the returned JSON.
    

### **Implementation Plan**

**Using AWS Console:**

1.  SSH into each worker node and find the Kubelet configuration file via ps -ef | grep kubelet.
    
2.  Open the configuration file and add or modify the readOnlyPort entry to be 0.
    
3.  Save the changes and restart the Kubelet service.
    

**Using AWS CLI:**

1.  Locate and open the configuration file on the worker node.
    
2.  Set the readOnlyPort value to 0 in the configuration file.
    
3.  If using systemd, modify the Kubelet service file at /etc/systemd/system/kubelet.service.d/10-kubelet-args.conf. Add the following line:  
    
    \--read-only-port=0
    

4.  Reload systemd and restart the Kubelet service:  
    
    systemctl daemon-reload
     systemctl restart kubelet.service
    systemctl status kubelet -l
    

### **Backout Plan**

**Using AWS Console:**

1.  If issues arise after disabling the read-only port, revert the changes made to the Kubelet configuration or systemd service.
    
2.  Restart the Kubelet service.
    

**Using AWS CLI:**

1.  Re-enable the read-only port by removing --read-only-port=0 or changing the readOnlyPort entry back to its default value.
    
2.  Restart the Kubelet service:  
    
    systemctl daemon-reload
    systemctl restart kubelet.service
    

### **References:**

-   [Kubernetes Kubelet Documentation](https://kubernetes.io/docs/admin/kubelet/)
    
-   [CIS EKS Benchmark v1.6.0](https://www.cisecurity.org/cis-benchmarks/)
    

[](https://kubernetes.io/docs/admin/kubelet/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.