> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Bind Address Argument Is 127.0.0.1

### More Info:

Do not bind the Controller Manager service to non-loopback insecure addresses.

### Risk Level

Critical

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, back up the existing manifest before editing:
           ```bash theme={null}
           sudo cp -a /etc/kubernetes/manifests/kube-controller-manager.yaml \
             /etc/kubernetes/manifests/kube-controller-manager.yaml.bak.$(date +%F-%H%M%S)
           ```

        2. Edit the controller manager static pod manifest on that control plane node:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```
           In the `spec.containers[0].command` (or `args`) list, add or update the bind address argument so it reads exactly:
           ```yaml theme={null}
           - --bind-address=127.0.0.1
           ```
           Ensure there is no other `--bind-address` entry with a different value.

        3. Save the file and exit the editor. The kubelet will automatically detect the change to `/etc/kubernetes/manifests/kube-controller-manager.yaml` and restart the `kube-controller-manager` static pod. This will momentarily restart the controller manager component on that control plane node.

        4. Wait for the controller manager pod to restart and become Ready (run on any machine with `kubectl` access):
           ```bash theme={null}
           kubectl -n kube-system get pods -o wide | grep kube-controller-manager
           ```
           Confirm the pod corresponding to this control plane node is in `Running` and `Ready` status.

        5. Verify the controller manager process is now using the loopback bind address on that control plane node:
           ```bash theme={null}
           /bin/ps -ef | grep kube-controller-manager | grep -v grep
           ```
           Confirm the output includes `--bind-address=127.0.0.1` and does not show `--bind-address` with any other IP.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the kube-controller-manager static pod manifest or its process flags. To remediate this finding, you must edit `/etc/kubernetes/manifests/kube-controller-manager.yaml` directly on every control plane node; see the Manual Steps section for exact instructions.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Remediation: Ensure kube-controller-manager --bind-address is set to 127.0.0.1
        # Scope: Run on every control plane node
        # Effect: Editing /etc/kubernetes/manifests/kube-controller-manager.yaml will
        #         cause the kube-controller-manager static pod to restart.

        set -euo pipefail

        MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml"
        TMP_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml.tmp.$$.bak"
        BACKUP_MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml.backup.$(date +%Y%m%d%H%M%S)"

        if [ ! -f "$MANIFEST" ]; then
          echo "ERROR: $MANIFEST not found on this node. Are you on a control plane node?"
          exit 1
        fi

        echo "Backing up existing manifest to $BACKUP_MANIFEST"
        cp -p "$MANIFEST" "$BACKUP_MANIFEST"

        # Idempotent edit of --bind-address within the kube-controller-manager container args
        # Handles cases:
        # - flag missing  -> adds it
        # - flag present with wrong value -> replaces with correct value
        # - flag already correct -> leaves as-is
        awk '
          $0 ~ /name: *kube-controller-manager/ { in_kcm=1 }
          in_kcm && $0 ~ /^ *- --bind-address=/ {
              sub(/--bind-address=[^[:space:]]+/, "--bind-address=127.0.0.1")
              found_flag=1
          }
          { print }
          END {
              if (in_kcm && !found_flag) {
                  # Inject flag line after the first args: line inside the kube-controller-manager container
                  # This requires a second pass done outside awk.
              }
          }
        ' "$MANIFEST" > "$TMP_MANIFEST"

        # Detect if we still need to inject the flag (i.e., it was not present)
        if ! grep -qE '^- +--bind-address=127\.0\.0\.1' "$TMP_MANIFEST"; then
          # Rebuild with injected flag under the kube-controller-manager container args
          awk '
            $0 ~ /name: *kube-controller-manager/ { in_kcm=1 }
            in_kcm && $0 ~ /^ *args:/ && !args_done {
                print
                print "    - --bind-address=127.0.0.1"
                args_done=1
                next
            }
            { print }
          ' "$TMP_MANIFEST" > "${TMP_MANIFEST}.withflag"
          mv "${TMP_MANIFEST}.withflag" "$TMP_MANIFEST"
        fi

        # Basic YAML sanity check: ensure we did not empty the file
        if ! grep -q "kube-controller-manager" "$TMP_MANIFEST"; then
          echo "ERROR: patched manifest does not look valid; not overwriting original."
          rm -f "$TMP_MANIFEST"
          exit 1
        fi

        echo "Updating $MANIFEST (this will restart kube-controller-manager static pod)..."
        mv "$TMP_MANIFEST" "$MANIFEST"

        echo "Waiting for kube-controller-manager process to restart..."
        sleep 15

        echo "Verifying that kube-controller-manager is bound to 127.0.0.1..."
        /bin/ps -ef | grep kube-controller-manager | grep -v grep || {
          echo "ERROR: kube-controller-manager process not found after modification."
          exit 1
        }

        if /bin/ps -ef | grep kube-controller-manager | grep -v grep | grep -q -- "--bind-address=127.0.0.1"; then
          echo "SUCCESS: kube-controller-manager is configured with --bind-address=127.0.0.1"
          exit 0
        else
          echo "ERROR: kube-controller-manager still not using --bind-address=127.0.0.1"
          echo "Current command line:"
          /bin/ps -ef | grep kube-controller-manager | grep -v grep
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/](https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/)