1.3.7 Ensure that the --address argument is set to 127.0.0.1

Information

Do not bind the Controller Manager service to non-loopback insecure addresses.

Rationale:

The Controller Manager API service which runs on port 10252/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface

Solution

Edit the Controller Manager pod specification file '/etc/kubernetes/manifests/kube-controller-manager.yaml' on the master node and ensure the correct value for the '--address' parameter

See Also

https://workbench.cisecurity.org/files/2421

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv6|9.1, CSCv7|9.2

Plugin: Unix

Control ID: e4da8f7e10f09f2c4a1ccfdf7f7550aa18f8cc35b53cd3d87af24ca989d43132