{
  "port": 8001,
  "protocol": "tcp",
  "service": "kubectl proxy, HTTP alternate",
  "oneLiner": "The default port for `kubectl proxy`, and the next HTTP port people grab after 8000.",
  "whatItIs": "IANA registers 8001 as vcom-tunnel, which you will essentially never meet. What you do meet is `kubectl proxy`, whose `--port` flag defaults to 8001 — it opens an authenticated channel to the Kubernetes API server and serves it locally. The rest of the time 8001 is simply the second HTTP port on a box that already used 8000, common in Docker Compose files and multi-service dev setups.",
  "exposure": {
    "verdict": "never",
    "note": "`kubectl proxy` authenticates to the cluster on your behalf and applies no authentication of its own, so anyone who reaches it inherits your cluster credentials. It binds 127.0.0.1 by default — leave it there."
  },
  "checkCommand": "curl -sI http://127.0.0.1:8001/api/",
  "links": [
    {
      "title": "Kubernetes — kubectl proxy (--port default 8001)",
      "url": "https://kubernetes.io/docs/reference/kubectl/generated/kubectl_proxy/",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry — 8001",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=8001",
      "kind": "iana"
    }
  ],
  "ianaName": "vcom-tunnel"
}