> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Ensure Bind Address Argument Is 127.0.0.1 ### More Info: Do not bind the scheduler service to non-loopback insecure addresses. ### Risk Level Critical ### Address Security ### Compliance Standards * CIS Kubernetes ### Triage and Remediation ### Remediation 1. On every control plane node, open the kube-scheduler static pod manifest for editing: ```bash theme={null} sudo vi /etc/kubernetes/manifests/kube-scheduler.yaml ``` 2. In the `spec.containers[0].command` (or `args`) section, locate any existing `--bind-address` flag. If present and not `127.0.0.1`, change it to: ```yaml theme={null} - --bind-address=127.0.0.1 ``` 3. If no `--bind-address` flag exists, add it under the scheduler container’s command/args list, for example: ```yaml theme={null} spec: containers: - name: kube-scheduler command: - kube-scheduler - --bind-address=127.0.0.1 ... ``` 4. Save the file and exit the editor. The kube-scheduler static pod will be automatically restarted by the kubelet because `/etc/kubernetes/manifests/kube-scheduler.yaml` changed. Allow 10–20 seconds for it to restart. 5. On the same control plane node, verify the running kube-scheduler process is using the correct bind address: ```bash theme={null} /bin/ps -ef | grep kube-scheduler | grep -v grep ``` 6. Confirm in the output that the kube-scheduler command line includes: ```text theme={null} --bind-address=127.0.0.1 ``` and that there is no conflicting `--bind-address` with a different value. Repeat all steps on every control plane node. kubectl cannot change the bind address for the kube-controller-manager or kube-scheduler because this setting is defined in the static pod manifest on each control plane node (for example, `/etc/kubernetes/manifests/kube-controller-manager.yaml` or `/etc/kubernetes/manifests/kube-scheduler.yaml`). To remediate this finding, follow the guidance in the Manual Steps section and edit the manifest directly on every control plane node. ```bash theme={null} #!/usr/bin/env bash # # Automation: Ensure kube-scheduler --bind-address is set to 127.0.0.1 # # Run on: every control plane node (with root privileges). # Effect: Editing /etc/kubernetes/manifests/kube-scheduler.yaml will # trigger a restart of the kube-scheduler static pod via kubelet. set -euo pipefail SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml" TMP_MANIFEST="/tmp/kube-scheduler.yaml.$$" echo "[*] Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}" if [[ ! -f "${SCHEDULER_MANIFEST}" ]]; then echo "[!] kube-scheduler manifest not found at ${SCHEDULER_MANIFEST}. Nothing to do on this node." exit 0 fi cp "${SCHEDULER_MANIFEST}" "${TMP_MANIFEST}" echo "[*] Ensuring --bind-address=127.0.0.1 is present and correct in kube-scheduler manifest" # Normalize any existing --bind-address argument to 127.0.0.1 inside the manifest # Works whether the arg is formatted with or without quotes. perl -pi -e ' if (/--bind-address=/) { s/--bind-address=\S+/--bind-address=127.0.0.1/; } ' "${TMP_MANIFEST}" # If no --bind-address arg exists, add it explicitly to the command args list. # This assumes a standard static pod manifest structure. if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then echo "[*] --bind-address not found; adding --bind-address=127.0.0.1 to kube-scheduler args" # Try to inject into an existing args list (YAML array form). if grep -q '^\s*args:\s*$' "${TMP_MANIFEST}"; then perl -0pi -e ' s/(^\s*args:\s*\n)((\s*-\s+.*\n)+)/$1$2\ \ - --bind-address=127.0.0.1\n/m ' "${TMP_MANIFEST}" || true fi # If still not present, try to append as a standalone command argument if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then # Fallback: append to the command array if present perl -0pi -e ' s/(^\s*command:\s*\n)((\s*-\s+.*\n)+)/$1$2\ \ - --bind-address=127.0.0.1\n/m ' "${TMP_MANIFEST}" || true fi fi # Final safety check before overwriting if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then echo "[!] Failed to ensure --bind-address=127.0.0.1 in temporary manifest. Not modifying live manifest." rm -f "${TMP_MANIFEST}" exit 1 fi echo "[*] Updating ${SCHEDULER_MANIFEST} (this will restart the kube-scheduler static pod)" cp "${TMP_MANIFEST}" "${SCHEDULER_MANIFEST}" chmod 600 "${SCHEDULER_MANIFEST}" rm -f "${TMP_MANIFEST}" echo "[*] Waiting for kube-scheduler process to restart with new arguments..." sleep 10 echo "[*] Verification: checking kube-scheduler process arguments" /bin/ps -ef | grep kube-scheduler | grep -v grep || { echo "[!] kube-scheduler process not found. Check kubelet and static pod status." exit 1 } if /bin/ps -ef | grep kube-scheduler | grep -v grep | grep -q -- "--bind-address=127.0.0.1"; then echo "[+] kube-scheduler is running with --bind-address=127.0.0.1" exit 0 else echo "[!] kube-scheduler is NOT running with --bind-address=127.0.0.1. Please review ${SCHEDULER_MANIFEST} and kubelet logs." exit 1 fi ``` ### Additional Reading: * [https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/)