Information
Do not bind the kube-proxy metrics port to non-loopback addresses.
Rationale:
kube-proxy has two APIs which provided access to information about the service and can be bound to network ports. The metrics API service includes endpoints (/metrics and /configz) which disclose information about the configuration and operation of kube-proxy. These endpoints should not be exposed to untrusted networks as they do not support encryption or authentication to restrict access to the data they provide.
Impact:
3rd party services which try to access metrics or configuration information related to kube-proxy will require access to the localhost interface of the node.
Solution
Modify or remove any values which bind the metrics service to a non-localhost address
Default Value:
The default value is 127.0.0.1:10249