1.3.7 Ensure that the --bind-address argument is set to 127.0.0.1

Information

Do not bind the Controller Manager service to non-loopback insecure addresses.

Rationale:

The Controller Manager API service which runs on port 10252/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface

Impact:

None

Solution

Edit the Controller Manager pod specification file /etc/kubernetes/manifests/kube-controller-manager.yaml on the master node and ensure the correct value for the --bind-address parameter

Default Value:

By default, the --bind-address parameter is set to 0.0.0.0

See Also

https://workbench.cisecurity.org/files/3891

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-18, 800-53|SC-23, CSCv7|9.2

Plugin: Unix

Control ID: 4805b2b79acc93a8050dbfd9abe746a9cb210a1d4b4bf4881200447d7bd74ee3