cyberstrikeus CIS Kubernetes Benchmark v1.12.0 - Control 1.3.7
Profile Applicability
- Level: 1 - Master Node
Description
Do not bind the Controller Manager service to non-loopback insecure addresses.
Rationale
The Controller Manager API service which runs on port 10252/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface.
Impact
None
Audit Procedure
Run the following command on the Control Plane node:
ps -ef | grep kube-controller-manager
Verify that the --bind-address argument is set to 127.0.0.1
Remediation
Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the Control Plane node and ensure the correct value for the --bind-address parameter.
Default Value
By default, the --bind-address parameter is set to 0.0.0.0
References
Additional Information
Although the current Kubernetes documentation site says that --address is deprecated in favour of --bind-address Kubeadm 1.11 still makes use of --address.
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 12.6 Use of Secure Network Management and Communication Protocols | |||
| v7 | 9.2 Ensure Only Approved Ports, Protocols and Services Are Running |
Profile
Level 1 - Master Node (Automated)