Best practices

Kubernetes Controller Manager –bind-address is not set to localhost

Platform(s)
  • Non-platform specific

Compliance Frameworks
  • CCPA
  • ,
  • CPRA
  • ,
  • iso_27001_2022
  • ,
  • iso_27002_2022
  • ,
  • K8s CIS
  • ,
  • Mitre ATT&CK
  • ,
  • NIST 800-171
  • ,
  • NIST 800-190
  • ,
  • NIST 800-53
  • ,
  • PDPA
  • ,
  • UK Cyber Essentials

Description

It was found that the argument --bind-address in the Controller Manager configuration file is not set to the IP address ""127.0.0.1"". This argument indicates the IP address with which the Controller Manager API service communicates. This service provides health and metrics information without an encryption or authentication. Therefore, in order to minimize attack surface, it should be bound to a localhost interface.