← Back to Kubernetes Security Technical Implementation Guide

V-242395

CAT II (Medium)

Kubernetes dashboard must not be enabled.

Rule ID

SV-242395r1137639_rule

STIG

Kubernetes Security Technical Implementation Guide

Version

V2R6

CCIs

CCI-000213

Discussion

While the Kubernetes dashboard is not inherently insecure on its own, it is often coupled with a misconfiguration of Role-Based Access control (RBAC) permissions that can unintentionally over-grant access. It is not commonly protected with "NetworkPolicies", preventing all pods from being able to reach it. In increasingly rare circumstances, the Kubernetes dashboard is exposed publicly to the internet.

Check Content

From the Control Plane, run the command:

kubectl get pods --all-namespaces -l k8s-app=kubernetes-dashboard

If any resources are returned, this is a finding.

Fix Text

Delete the Kubernetes dashboard deployment with the following command:

kubectl delete deployment kubernetes-dashboard --namespace=kube-system