Port 10250: Kubernetes kubelet API

Kubernetes kubelet API

kubelet — agent on every K8s node. Port 10250 — secure API for controller-manager and kube-apiserver. 10255 — deprecated read-only port (removed in K8s 1.20+). Access to kubelet = pod exec = node takeover.

kubelet 10250 exposed without auth = critical vuln (Tesla hack 2018). Cilium/Calico network policies mandatory. Firewall inside cluster.

Check port online →

Enterno.io Ping + Port checker tests TCP reachability of any port from 3 regions (Moscow / Frankfurt / Virginia).

The Kubernetes Kubelet API, accessible via port 10250, serves as a crucial interface for communication between the kubelet and other Kubernetes components, such as the controller-manager and the kube-apiserver. This TCP port enables secure access to various management and operational functionalities of the kubelet, which is the primary agent that runs on each node in a Kubernetes cluster.

When a pod is created, the kubelet is responsible for ensuring that the containers are running and healthy. It reports the status of these containers back to the control plane, utilizing the Kubelet API over port 10250. This API allows for operations such as retrieving metrics, managing pod lifecycle, and executing commands within the containers.

Security is a critical aspect when dealing with the Kubelet API. It is recommended to restrict access to port 10250 to trusted sources only, as it can expose sensitive information about the cluster and its workloads. 

Interacting with the Kubernetes Kubelet API over port 10250 can be accomplished using various command-line tools, such as curl or kubectl. Below are practical examples that demonstrate how to query the Kubelet API and manage pods:

• To retrieve the status of the kubelet and its nodes, you can execute the following command:

  curl -k https://:10250/pods

• To get detailed information about a specific pod, use:

  curl -k https://:10250/pods//

• To execute a command inside a running container, leverage the API like this:

  curl -k -X POST https://:10250/pods///exec?command=&stdout=true&stderr=true

Make sure to replace <NODE_IP>, <NAMESPACE>, <POD_NAME>, and <COMMAND> with your specific values. Note that authentication and proper certificates will be required to successfully communicate with the kubelet API.

Securing access to port 10250 is paramount to protect your Kubernetes cluster from unauthorized access and potential vulnerabilities. Below are essential considerations and best practices to enhance the security of the Kubelet API:

• Network Policies: Implement Kubernetes network policies to restrict access to the kubelet API. Only allow trusted IP addresses or CIDR blocks to communicate with port 10250.
• Authentication: Ensure that proper authentication mechanisms are in place, such as client certificates or bearer tokens. This prevents unauthorized users from accessing the API.
• Authorization: Use Role-Based Access Control (RBAC) to manage permissions for what actions can be performed through the kubelet API. Limit access to only those users who require it.
• Disable Read-Only Port: As port 10255 has been deprecated and removed in K8s 1.20+, ensure that it is disabled in your configuration to minimize the attack surface.

By adhering to these security measures, you can significantly reduce the risk of exposing critical components of your Kubernetes cluster and maintain a secure operational environment.