<p>I have created a GKE private cluster (<em>version: 1.13.6-gke.13</em>) using the following command:</p>

<pre><code>gcloud container clusters create a-cluster-with-user-pass \
 --network vpc-name \
 --subnetwork subnet-name    \
 --enable-master-authorized-networks \
 --username random \
 --password averylongpassword \
 --enable-ip-alias \
 --enable-private-nodes \
 --enable-private-endpoint \
 --master-ipv4-cidr xxx.xx.xx.xx/28 \
 --cluster-version 1.13.6-gke.13 \
 --num-nodes 2 \
 --zone asia-south1-a
</code></pre>

<p>I can see that the port (10255) is open in both the nodes (or we can say GCP compute instances) created in the above cluster.</p>

<p>If I create a simple GCP compute instances (so I have in total 3 VM instances) and try to access the internal IP of the GKE node on 10255 port from this VM I am able to access it without any authentication or authorization.
Below is the command used to create the GCP compute instance:</p>

<pre><code>gcloud compute instances create vm-name \
 --network vpc-name \
 --subnetwork subnet-name    \
 --zone asia-south1-a
</code></pre>

<p>If I send a simple CURL GET request to (<strong><em>xxx.xx.xx.xx:10255/pods</em></strong>) I get tons of information about the pods and applications.
As I can see in the documentation of Kubernetes <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/" rel="noreferrer">here</a>, it is mentioned that:</p>

<pre><code>--read-only-port int32
     The read-only port for the Kubelet to serve on with no authentication/authorization (set to 0 to disable) (default 10255)
</code></pre>

<p>I tried disabling the port by editing <code>kube-config.yaml</code> file in the node by doing an <code>ssh</code> and restarting the kubelet and I was successful. But is this a good approach? I believe there could be multiple issues when <strong><em>xxx.xx.xx.xx:10255/metrics</em></strong> is disabled. Is there way to secure the port? Rather than disabling it?</p>

<p>I see this <a href="https://github.com/kubernetes/kubernetes/issues/44330" rel="noreferrer">github issue</a> and I am certain that there is a way to secure this port. I'm not sure how to do that.</p>

<p>I see Kubernetes documentation in general provides us with multiple ways to secure the port. How to do that in Google Kubernetes Engine?</p>

Amit Yadav
<p>Kubelet is exposing the collected node metrics using this port. Failure to expose these metrics there might lead to unexpected behavior as the system will be essentially flying blind.</p>

<p>Since GKE is a managed system, you're not really supposed to tweak the kubelet flags as the settings will be reset when a node gets recreated (nodes are based in GCE templates that will not include your own configuration).</p>

<p>As for security, I think is safe to leave that port as is, since you're using a private cluster, meaning that only the resources in the same VPC are allowed to reach the nodes.</p>
