如何检查Azure Kubernetes集群（AKS）中是否启用insecure-port

Hey there! Let's walk through how to verify if the insecure port is enabled on your Azure Kubernetes Service (AKS) cluster's API server. Here are two reliable methods to get this info:

Method 1: Inspect the Kube-APIServer Pod Configuration #

The AKS API server runs as a pod in the kube-system namespace, so we can directly check its startup arguments to confirm the insecure port status:

• First, list all API server pods in the kube-system namespace:

  kubectl get pods -n kube-system | grep kube-apiserver
  

• Pick one of the pod names from the output, then describe it to view the startup parameters:

  kubectl describe pod <kube-apiserver-pod-name> -n kube-system
  

• Look for the --insecure-port flag in the Command section of the output:
  • If you see --insecure-port=0, that means the insecure port is disabled (this is the default AKS configuration).
  • If the flag is set to a numerical value like 8080, the insecure port is enabled.

Method 2: Verify via Azure CLI (Cluster-Level Configuration) #

You can also check the AKS cluster's official configuration using Azure CLI to cross-validate:

• Run the following command to fetch the API server profile details:

  az aks show --resource-group <your-resource-group-name> --name <your-aks-cluster-name> --query apiServerProfile
  

• By default, AKS disables the insecure port as part of its security best practices. If you've customized the cluster to enable it, this output will reflect the relevant configuration overrides.

A quick note: Microsoft strongly recommends keeping the insecure port disabled to avoid exposing your cluster API server to unauthenticated or unencrypted traffic. Only enable it if you have a specific, secure use case in mind.

Hope these steps help you confirm the status of the insecure port on your AKS cluster. Feel free to reach out if you hit any snags!

内容的提问来源于stack exchange，提问作者srinivasa mahendrakar