Port 10252Kubernetes kube-controller-manager (legacy insecure endpoint)

Often used by Kubernetes kube-controller-manager for a legacy, unauthenticated HTTP endpoint; it is not the IANA-assigned Apollo Relay service.

inNetwork Services System

transport: tcp · udp
in transit: cleartext
assignment: official
risk: 5/10
lookups: 0

also known as apollo-relay, kube-controller-manager, Kubernetes controller manager

Technical Details

what runs on :10252

The IANA assignment is Apollo Relay Port, but Kubernetes has used TCP 10252 for kube-controller-manager’s legacy insecure HTTP serving endpoint. When enabled, it can serve component metrics and health information without TLS; its availability and bind address depend on Kubernetes version and configuration, and it is often disabled or restricted to localhost in newer setups. The corresponding secure serving port is typically TCP 10257.

Security Information

exposure of :10252

risk score

5/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

network services averages 2.6 across 1,876 ports — this one sits 2.4 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Do not expose this endpoint to the internet: legacy insecure serving lacks TLS and authentication, so reachable metrics and health information can be read by unauthenticated clients. Restrict or disable it, and use the secure endpoint and appropriate access controls for monitoring.

Record

iana registry entry

port: :10252
service: Kubernetes kube-controller-manager (legacy insecure endpoint)
transport: TCPUDP
encryption: cleartext
assignment: iana registered
risk: 5/10caution
category: Network Services System
usage: IANA assigns this port as “Apollo Relay Port” to Anthony Carrabino, but a well-known real-world use is the legacy insecure endpoint of Kubernetes kube-controller-manager. Engineers may encounter it on Kubernetes control-plane nodes, though newer configurations commonly disable it or bind it only to loopback.
lookups: 0rank 993
added: 2026-10-16
updated: 2026-10-16
references: IANA service name registry — port 10252

Something wrong?

This record is maintained by the engineers who use port 10252. Every field on it is editable — change what's wrong, say how you know, and a reviewer publishes it, usually within a minute. Last touched 2026-10-16.

01edit any field on a page of its own
02a model checks it for accuracy and spam
03clean and confident goes live immediately

edit this record →back to the registry

Related Ports

all 1,876 in network services →

the 8 most looked-up other ports in network services — 1,876 ports carry that label.

port	service	proto	category	risk	views
:9080	Groove RPC	TCPUDP	Web Services	caution	70.8k
:6543	Jetnet	UDP	Network Services	caution	65.3k
:5938	TeamViewer	TCPUDP	Remote Access	caution	65.0k
:8291	Winbox MikroTik Admin	TCP	Security	caution	62.9k
:3233	WhiskerControl Protocol	TCPUDP	Network Services	caution	61.9k
:3268	Microsoft Global Catalog (GC)	TCPUDP	Security	caution	54.6k
:135	Microsoft EPMAP	TCPUDP	Security	caution	51.9k
:3128	Tatsoft Default HTTP Proxy	TCP	Web Services	caution	46.8k

risk mix of the 8 listed

caution100%

0 of 8 encrypted

Port :10252Kubernetes kube-controller-manager (legacy insecure endpoint)

Technical Details

Security Information

Related Ports

Port 10252Kubernetes kube-controller-manager (legacy insecure endpoint)