What uses port 10250
The API server reaches each node’s kubelet on 10250 to fetch logs, run kubectl exec and collect metrics. An exposed kubelet that allows anonymous access lets attackers run commands in any container on the node, so anonymous auth must be off and the port reachable only from the control plane.
Should port 10250 be open to the internet?
Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.
Check what is listening on port 10250
sudo ss -ltnp 'sport = :10250'sudo lsof -nP -iTCP:10250 -sTCP:LISTENGet-NetTCPConnection -LocalPort 10250 -State Listen
netstat -ano | findstr :10250No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 10250
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:10250 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 10250 -State Listen).OwningProcessAllow port 10250 from trusted networks only
The examples allow 10250 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 10250 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 10250 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="10250" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "Kubelet API 10250/TCP" -Direction Inbound -Protocol TCP -LocalPort 10250 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 10250 from another machine
nc -zv example.com 10250Test-NetConnection example.com -Port 10250Related ports
- Port 6443 (Kubernetes API server): the default port of the Kubernetes API server.
- Port 2379 (etcd client): the etcd client API port, used by the Kubernetes API server.
More containers and orchestration ports
2375 (Docker API (unencrypted)) , 2376 (Docker API (TLS)) , 2380 (etcd peer) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 10250 used for?
Port 10250 is the kubelet API on every Kubernetes node. The API server reaches each node’s kubelet on 10250 to fetch logs, run kubectl exec and collect metrics. An exposed kubelet that allows anonymous access lets attackers run commands in any container on the node, so anonymous auth must be off and the port reachable only from the control plane.
Is it safe to open port 10250?
Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 10250 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :10250'" on Linux or "sudo lsof -nP -i :10250" on macOS. From another machine, run "nc -zv host 10250" or, on Windows, "Test-NetConnection host -Port 10250". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.