@liggitt said, very reasonably:

kubeadm should also disable the readonly port to follow best practices.

ref: kubernetes/kubernetes#59666 (comment)

While we already protect the most essential parts (e.g. disable cAdvisor, protect the API using the authorizer, etc.), we could lock this down by default more as well before going to GA.

cc @timothysc @kad @stealthybox