The --bind-address argument for controller managers is not set to 127.0.0.1 misconfiguration detecte

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_113
Category - Subcategory	Kubernetes - Native Security Controls
Provider	OTHER
Severity	HIGH
Framework	Helm, Kubernetes, Kustomize

Impact

Do not bind the Controller Manager service to non-loopback insecure addresses. The Controller Manager API service which runs on port 10252/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface

How to Fix

Kind: Pod [source,go]

{ " apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers:

• command:
• kube-controller-manager
• • --bind-address=127.0.0.1 image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0", }

---