Block untrusted or unauthenticated paths to worker-node administration, kubelet interfaces, and instance metadata.
Restrict Node Administrative Access
CCC.K8S.CN12 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP02 | Managed Worker Pools | The service can organize worker nodes into managed pools that provide Kubernetes with compute capacity for scheduling and running containerized workloads. |
| CCC.K8S.CP03 | Abstracted Worker Infrastructure | The service may be configured to abstract worker infrastructure so that provisioning, scaling, patching, and replacement occur without exposing individual nodes to the user. |
| CCC.K8S.CP19 | Workload Isolation Controls | The service can separate workloads with security contexts, namespace boundaries, scheduling constraints, and runtime isolation settings. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH14 | Node Administrative Interfaces Expose Cluster Credentials | Node administrative interfaces reachable without sufficient authentication or network restriction may expose node metadata, workload credentials, logs, or execution functions. The node can then be queried or controlled outside the intended management path, allowing credential disclosure, unauthorized host changes, or disruption of scheduled workloads. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN12.AR01 | When a worker node is active, kubelet and node administrative APIs MUST require authentication and authorization AND anonymous or read-only unauthenticated access MUST be disabled. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN12.AR02 | When SSH, RDP, or another node management interface is enabled, it MUST NOT be reachable from the public internet and MUST be restricted to an approved authenticated management path. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN12.AR03 | When a workload does not require instance metadata, network access from that workload to the node metadata service MUST be denied. | tlp-green, tlp-amber, tlp-red |