In a productive environment, the number of required NodePort services is known. Therefore, the range of ports can be limited accordingly. It is therefore not possible for an attacker to deploy additional NodePorts services for the time being.

For this purpose, the flag "--service-node-port-range" must be adjusted in the API config. 

In Azure, services are carried to the outside via a load balancer. Therefore, nothing can be done here.  

Included in the following risks

Any Questions?

Please feel free to contact us for any question that is not answered yet. 

We are looking forward to get in contact with you!


Design Escapes

KubeOps GmbH
Hinter Stöck 17
72406 Bisingen

  • Telefon:

    +49 7433 93724 90

  • Mail:

    This email address is being protected from spambots. You need JavaScript enabled to view it.

Download Area
Certified as

KubeOps GmbH is the owner of the Union trademark KubeOps with the registration number 018305184. 

© KubeOps GmbH. All rights reserved. Subsidiary of