Skip to main content
protocols.pageprotocols.page
6443

Port 6443 – Kubernetes API Server

TCP

Port 6443 is the default Kubernetes API server HTTPS port. All kubectl commands, operators, controllers, and admission webhooks communicate through this port. Managed Kubernetes (EKS, GKE, AKS) expose port 6443 to authorized clients. The API server requires mutual TLS authentication – kubeconfig files contain the certificates for access.

Port Number

6443

Protocol

TCP

Service

Kubernetes API Server HTTPS

Range

IANA Registered (1024–49151)

Description

The Kubernetes API server on port 6443 is the central control plane component. Every Kubernetes operation (create pod, list services, apply manifests) goes through port 6443. Authentication uses X.509 certificates, service account tokens, OIDC, or webhook authentication. In managed Kubernetes, the API server endpoint is a load balancer in front of multiple control plane nodes. Port 443 is sometimes used as an alias.

Security risks

  • 1CVE-2019-11247: Cluster-scoped resources accessible at namespace level – allowed unauthorized access to cluster resources by users with only namespace permissions
  • 2CVE-2021-25741: Symlink exchange vulnerability – pods could access host filesystem outside their allowed path via race condition in kubelet volume handling
  • 3Anonymous auth enabled (--anonymous-auth=true): system:anonymous user can discover API endpoints, and misconfigurations (ClusterRoleBindings to system:unauthenticated) give full cluster access
  • 4Exposed etcd on port 2379: if etcd is reachable, attackers bypass the API server entirely and read/write all cluster state including Secrets (base64, not encrypted at rest by default)
  • 5Stolen ServiceAccount tokens: any pod token leaked (via SSRF, log exposure, or container escape) authenticates as that ServiceAccount – if it has cluster-admin, game over

Firewall guidance

In managed Kubernetes (EKS, GKE, AKS): restrict API endpoint access to authorized CIDR ranges via cluster configuration (e.g., EKS: endpointPublicAccess + publicAccessCidrs). Self-managed: port 6443 should be reachable only from kubectl clients (admin networks), worker nodes (node registration), and CI/CD systems. Use private endpoints when possible.

Diagnosis commands

Verify API server endpoint and health

shell
kubectl cluster-info

Test API server authentication from within a pod

shell
curl -sk https://localhost:6443/api/v1 --header 'Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)'

Check what anonymous users can do (should be nothing or very limited)

shell
kubectl auth can-i --list --as=system:anonymous

Find ClusterRoleBindings granting access to unauthenticated users

shell
kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[]?.name=="system:unauthenticated") | .metadata.name'

Usage examples

Port 6443 – Kubernetes API Server
shell
kubectl cluster-info
curl -k https://APISERVER:6443/api/v1/namespaces
kubectl config view --raw | grep server

Common services on this port

Kubernetes API Server (kube-apiserver)OpenShift APIk3s serverRancher RKE2EKS/GKE/AKS managed control plane

Related ports

10250

Kubelet API (worker node)

2379

etcd client (cluster state)

2380

etcd peer (cluster replication)

8443

Kubernetes API alternate (some distros)

443

HTTPS (API server behind LB)

History

Kubernetes API server has used port 6443 since early Kubernetes versions (2014). The port was chosen as a common HTTPS alternate (many load balancers use 443, leaving 6443 for the actual service). Before RBAC (added in 1.6, stable in 1.8), Kubernetes used ABAC policies which were error-prone. EKS (2018), GKE (2015), and AKS (2018) manage the control plane, eliminating most operator mistakes around API server exposure.

FAQ

Should my Kubernetes API be publicly accessible?

For production: prefer private endpoint (EKS: endpointPublicAccess=false, endpointPrivateAccess=true) + VPN/bastion for admin access. If public is needed (CI/CD without VPN), restrict to specific CIDR ranges. Never leave 6443 open to 0.0.0.0/0. Even with RBAC, exposed API servers face brute-force token attacks and zero-day exploits.

How do I audit who is accessing my API server?

Enable audit logging: --audit-log-path and --audit-policy-file in kube-apiserver args. Use a policy that logs RequestReceived at Metadata level and ResponseComplete at Request level for sensitive resources (secrets, roles, bindings). Send audit logs to a SIEM. In EKS: enable control plane logging for 'audit' log type in cluster configuration.