Detections
Analytics

1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1

Information

Do not bind the scheduler service to non-loopback insecure addresses.

The Scheduler API service which runs on port 10251/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface

Solution

Edit the Scheduler pod specification file /etc/kubernetes/manifests/kube-scheduler.yaml on the Control Plane node and ensure the correct value for the --bind-address parameter

Impact:

None

See Also

https://workbench.cisecurity.org/benchmarks/26831

Item Details

Category: ACCESS CONTROL, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-18, 800-53|SC-23, CSCv7|9.2

Plugin: Unix

Control ID: 6b0656a3f25dd5f434c1eee9ccf4ca14c0a4adda674fe9f0f82db91804aee955