Port 10255 (Kubelet read-only port)

Deprecated unauthenticated read-only kubelet API; disabled by default in current Kubernetes.

Registered (user) port, 1024-49151 TCP Containers and Kubernetes Do not expose to the internet

What port 10255 is used for

Deprecated unauthenticated read-only kubelet API; disabled by default in current Kubernetes.

Do not expose to the internet. If it is open, it leaks pod specs and environment variables. Set readOnlyPort: 0.

Port 10255 is in the registered range and has no IANA assignment. The usage above is unofficial but widespread.

Linux: is anything listening on TCP 10255?

sudo ss -tlnp 'sport = :10255'

Linux / macOS: which process owns the port

sudo lsof -nP -i :10255

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':10255 '

Windows (Command Prompt)

netstat -ano | findstr :10255

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 10255 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 10255

From Windows

Test-NetConnection HOST -Port 10255

ufw

sudo ufw deny 10255/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 10255 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 10255 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 10255' -Direction Inbound -Protocol TCP -LocalPort 10255 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.