Skip to main content

Ensure Bind Address Argument Is 127.0.0.1

More Info:​

Do not bind the Controller Manager service to non-loopback insecure addresses.

Risk Level​

Critical

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, back up the existing manifest before editing:

    sudo cp -a /etc/kubernetes/manifests/kube-controller-manager.yaml \
      /etc/kubernetes/manifests/kube-controller-manager.yaml.bak.$(date +%F-%H%M%S)

  2. Edit the controller manager static pod manifest on that control plane node:

    sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml

    In the spec.containers[0].command (or args) list, add or update the bind address argument so it reads exactly:

    - --bind-address=127.0.0.1

    Ensure there is no other --bind-address entry with a different value.

  3. Save the file and exit the editor. The kubelet will automatically detect the change to /etc/kubernetes/manifests/kube-controller-manager.yaml and restart the kube-controller-manager static pod. This will momentarily restart the controller manager component on that control plane node.

  4. Wait for the controller manager pod to restart and become Ready (run on any machine with kubectl access):

    kubectl -n kube-system get pods -o wide | grep kube-controller-manager

    Confirm the pod corresponding to this control plane node is in Running and Ready status.

  5. Verify the controller manager process is now using the loopback bind address on that control plane node:

    /bin/ps -ef | grep kube-controller-manager | grep -v grep

    Confirm the output includes --bind-address=127.0.0.1 and does not show --bind-address with any other IP.

Using kubectl

kubectl cannot modify the kube-controller-manager static pod manifest or its process flags. To remediate this finding, you must edit /etc/kubernetes/manifests/kube-controller-manager.yaml directly on every control plane node; see the Manual Steps section for exact instructions.

Automation
#!/usr/bin/env bash
#
# Remediation: Ensure kube-controller-manager --bind-address is set to 127.0.0.1
# Scope: Run on every control plane node
# Effect: Editing /etc/kubernetes/manifests/kube-controller-manager.yaml will
#         cause the kube-controller-manager static pod to restart.

set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml"
TMP_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml.tmp.$$.bak"
BACKUP_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml.backup.$(date +%Y%m%d%H%M%S)"

if [ ! -f "$MANIFEST" ]; then
  echo "ERROR: $MANIFEST not found on this node. Are you on a control plane node?"
  exit 1
fi

echo "Backing up existing manifest to $BACKUP_MANIFEST"
cp -p "$MANIFEST" "$BACKUP_MANIFEST"

# Idempotent edit of --bind-address within the kube-controller-manager container args
# Handles cases:
# - flag missing  -> adds it
# - flag present with wrong value -> replaces with correct value
# - flag already correct -> leaves as-is
awk '
  $0 ~ /name: *kube-controller-manager/ { in_kcm=1 }
  in_kcm && $0 ~ /^ *- --bind-address=/ {
      sub(/--bind-address=[^[:space:]]+/, "--bind-address=127.0.0.1")
      found_flag=1
  }
  { print }
  END {
      if (in_kcm && !found_flag) {
          # Inject flag line after the first args: line inside the kube-controller-manager container
          # This requires a second pass done outside awk.
      }
  }
' "$MANIFEST" > "$TMP_MANIFEST"

# Detect if we still need to inject the flag (i.e., it was not present)
if ! grep -qE '^- +--bind-address=127\.0\.0\.1' "$TMP_MANIFEST"; then
  # Rebuild with injected flag under the kube-controller-manager container args
  awk '
    $0 ~ /name: *kube-controller-manager/ { in_kcm=1 }
    in_kcm && $0 ~ /^ *args:/ && !args_done {
        print
        print "    - --bind-address=127.0.0.1"
        args_done=1
        next
    }
    { print }
  ' "$TMP_MANIFEST" > "${TMP_MANIFEST}.withflag"
  mv "${TMP_MANIFEST}.withflag" "$TMP_MANIFEST"
fi

# Basic YAML sanity check: ensure we did not empty the file
if ! grep -q "kube-controller-manager" "$TMP_MANIFEST"; then
  echo "ERROR: patched manifest does not look valid; not overwriting original."
  rm -f "$TMP_MANIFEST"
  exit 1
fi

echo "Updating $MANIFEST (this will restart kube-controller-manager static pod)..."
mv "$TMP_MANIFEST" "$MANIFEST"

echo "Waiting for kube-controller-manager process to restart..."
sleep 15

echo "Verifying that kube-controller-manager is bound to 127.0.0.1..."
/bin/ps -ef | grep kube-controller-manager | grep -v grep || {
  echo "ERROR: kube-controller-manager process not found after modification."
  exit 1
}

if /bin/ps -ef | grep kube-controller-manager | grep -v grep | grep -q -- "--bind-address=127.0.0.1"; then
  echo "SUCCESS: kube-controller-manager is configured with --bind-address=127.0.0.1"
  exit 0
else
  echo "ERROR: kube-controller-manager still not using --bind-address=127.0.0.1"
  echo "Current command line:"
  /bin/ps -ef | grep kube-controller-manager | grep -v grep
  exit 1
fi

Additional Reading:​