A ZoomEye port query returned 4,138,087 hosts on Kubernetes' conventional API port

A port query records one thing: something accepted a connection on the queried port at collection time. The dev.to write-up says a TCP handshake or TLS banner does not tell you whether the API server requires client certificates, bearer tokens or OIDC, nor whether anonymous requests are bound to any role ^[5].

The reason the port is worth counting at all is what answers behind it. The author describes the API server as the front door to the etcd datastore, the admission control chain, the authorization layer, and the credential issuance machinery for every workload identity in the cluster ^[12]. None of that is a vulnerability in Kubernetes ^[16]. A caller who can create or modify workloads can often obtain code execution on nodes, mount secrets, or reach cloud metadata endpoints through workload identity ^[13].

Coverage is where the query is weakest. 6443 is the conventional kube-apiserver default and the port most tooling and documentation assume ^[6]. The post names three others in real use: 443 on managed control planes behind load balancers, 8443 in some distributions, and 8080 for the legacy insecure port that modern releases removed ^[7]. The query therefore matches one of four ports the author names, two of the other three still being live options ^[1]. A cluster fronted only on 443, or reachable only through a VPN, a bastion or a private load balancer, is absent from the result ^[9].

The figure is offered as a lower-bound-style indicator of public exposure on one conventional port ^[10]. That holds for the port and not for Kubernetes. Any proxy, internal API, test harness or unrelated TLS service can bind 6443 and match the query ^[8], so the count includes hosts that are not control planes while omitting control planes that listen elsewhere ^[2].

I would copy the framing before the number. The write-up states the result is an exposure count, not a vulnerability count, and that a host answering on TCP 6443 has not been shown to be unauthenticated, misconfigured, or compromised ^[2]. It also declines to call the result a count of clusters, since one cluster can present multiple addresses and one address can front many clusters ^[3]. That paragraph has to travel with the 4,138,087 or the 4,138,087 becomes a tally of broken clusters somewhere up the reporting chain.

For your own estate the equivalent measurement is not an internet scan. The author's list of accident modes points at two settings: managed clusters, lab environments, CI runners and self-hosted installs often inherit permissive security groups or bind to all interfaces during setup and never get tightened ^[15]. Network-level filtering depends on that configuration being correct, because on the wire the API server is an ordinary HTTPS service that blends into ordinary web traffic ^[14].