Skip to main content
protocols.pageprotocols.page
10250

Port 10250 – Kubernetes Kubelet API

TCP

Port 10250 is the Kubernetes kubelet's main HTTPS API port. The kubelet API allows the API server to communicate with nodes – executing commands in pods, fetching logs, and probing container health. Exposed port 10250 without authentication has been exploited in multiple Kubernetes cryptomining attacks. Node firewall rules must restrict access to the API server's IP range only.

Port Number

10250

Protocol

TCP

Service

Kubernetes Kubelet HTTPS API

Range

IANA Registered (1024–49151)

Description

The kubelet API on port 10250 is critical infrastructure. Through it, kubectl exec, kubectl logs, and liveness probes work. An unauthenticated kubelet (pre-Kubernetes 1.10 default) allows running arbitrary commands in any pod on the node. Port 10255 is the read-only HTTP kubelet API (deprecated). Network policies and cloud security group rules should allow port 10250 only from the control plane.

Security risks

  • 1CVE-2018-1002105 (critical): Kubernetes API server privilege escalation via kubelet API – attacker could escalate to cluster-admin via crafted requests to kubelet proxy (CVSS 9.8)
  • 2Unauthenticated kubelet API (--anonymous-auth=true, legacy default): allows listing all pods, exec into any container, reading container logs, and downloading secrets mounted as volumes
  • 3Container escape via /exec endpoint: attacker with kubelet API access can kubectl exec into privileged containers and break out to the host via /proc or device access
  • 4Secret exfiltration via /configz endpoint: exposes kubelet configuration including bootstrap tokens and certificate paths
  • 5Port 10255 (kubelet read-only): many clusters still expose this unauthenticated port, leaking pod specs (with environment variables containing secrets) to anyone on the network

Firewall guidance

Port 10250 must only be accessible from: (1) Kubernetes API server (for exec, logs, port-forward), (2) monitoring systems (Prometheus kubelet metrics). Block from all other sources including other worker nodes. In AWS EKS, the managed control plane handles this via security groups. Self-managed: use NetworkPolicy + host-level iptables. Ensure --anonymous-auth=false and --authorization-mode=Webhook.

Diagnosis commands

List pods on this node via kubelet API (should require auth)

shell
curl -sk https://localhost:10250/pods | jq '.items[].metadata.name'

Kubelet health check (typically allowed anonymous)

shell
curl -sk https://localhost:10250/healthz

Read kubelet config via API server proxy (check authentication settings)

shell
kubectl get --raw /api/v1/nodes/<node>/proxy/configz | jq .kubeletconfig

Scan for exposed kubelets in the cluster network (security audit)

shell
nmap -sV -p 10250,10255 --open 10.0.0.0/16

Usage examples

Port 10250 – Kubernetes Kubelet API
shell
curl -k https://NODE_IP:10250/pods
curl -k https://NODE_IP:10250/metrics

Common services on this port

Kubernetes kubeletOpenShift node agentk3s agentRancher RKE2

Related ports

6443

Kubernetes API server (control plane)

10255

Kubelet read-only (deprecated, dangerous)

10256

Kube-proxy health check

2379

etcd (cluster state store)

History

The kubelet has been part of Kubernetes since the very beginning (2014, Google's Borg-derived design). Port 10250 was chosen for the HTTPS API, 10255 for a read-only HTTP port. The read-only port was deprecated in Kubernetes 1.10 (2018) but many clusters still expose it. Kubernetes 1.19+ defaults to --anonymous-auth=false on the kubelet. The Tesla cryptojacking incident (2018) exploited an exposed kubelet dashboard.

FAQ

How do I check if my kubelet is properly secured?

Run: kubectl get --raw /api/v1/nodes/<node>/proxy/configz | jq '.kubeletconfig.authentication'. Verify: authentication.anonymous.enabled is false, authentication.webhook.enabled is true, authorization.mode is 'Webhook'. Also verify port 10255 is closed: curl http://<node>:10255/pods should fail.

What is the difference between 10250 and 10255?

Port 10250 is the kubelet's authenticated HTTPS API (exec, logs, metrics, port-forward). Port 10255 is a read-only HTTP port with NO authentication that exposes /pods, /spec, /stats. Port 10255 should be completely disabled (--read-only-port=0). In modern Kubernetes (1.26+), it's disabled by default.