C-0150 - Ensure that the Controller Manager --bind-address argument is set to 127.0.0.1
Framework
cis-v1.23-t1.0.1
Severity
Medium
Description of the the issue
The Controller Manager API service which runs on port 10252/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface
Related resources
Pod
What does this control test
Do not bind the Controller Manager service to non-loopback insecure addresses.
How to check it manually
Run the following command on the Control Plane node:
ps -ef | grep kube-controller-manager
Verify that the --bind-address
argument is set to 127.0.0.1
Remediation
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml
on the Control Plane node and ensure the correct value for the --bind-address
parameter
Impact Statement
None
Default Value
By default, the --bind-address
parameter is set to 0.0.0.0
Example
No example
Updated 3 days ago