Enable hsts for kublet API

General Discussions
#1

Hello All,
Is there way to enable hsts for kublet API?. our scanner flagged “HSTS Missing From HTTPS Server” for port 10250 on each worker node.

Cluster information:

Kubernetes version: 1.21.3
Installation method: bare-metal
Host OS: RHEL 7
CNI and version: weave - 0.3.0
CRI and version:docker - 20.10.8

#2

Hi durairajasivam,

did you found any solution or workaround for this ?

#3

We hit the same warning from Nexus, does it make sense to have HSTS on API? I mean it is not browser call

#4

I’m not sure I get it right! It is possible to enable HSTS for the Kube-API server, but I can’t find the solution to enable HSTS for Kubelet-API. What I have done is, apply proper hardening for port 10250 in our environment. Since the ports need to be allowed between the nodes, it is easier to achieve.

#5

Hi Parthasarathi_PM,
Apologies for the late reply.
I can’t find the solution to enable HSTS for Kubelet-API. What I have done is, apply proper hardening for port 10250 in our environment. Since the ports need to be allowed between the nodes.

#6

@durairajasivam

thanks for the reply

i have raised a issue in github for the same
since the kubelet 10250 is not public facing endpoint HSTS is not required, kubelet endpoint is completely internal and non browser endpoint.

1 Like