Skip to main content

Ensure Controller Profiling Argument Is False

More Info:​

Disable profiling, if not needed.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, open the kube-controller-manager static pod manifest for editing:

    sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml

  2. In the spec.containers[0].command (or args) list, add or modify the profiling flag so it is explicitly disabled. Ensure there is only one --profiling entry and it is set to false, for example:

    - --profiling=false

    Remove or correct any existing --profiling=true.

  3. Save the file and exit the editor. Because this is a static pod manifest under /etc/kubernetes/manifests, the kubelet on the control plane node will automatically restart the kube-controller-manager pod to apply the new setting. This causes a brief restart of the controller-manager component.

  4. Wait for the kube-controller-manager pod to be recreated and running:

    sudo crictl ps | grep kube-controller-manager

    or, from any machine with kubectl access:

    kubectl -n kube-system get pods -l component=kube-controller-manager

  5. On every control plane node, verify that the controller-manager process is now running with --profiling=false:

    ps -ef | grep kube-controller-manager | grep -v grep

    Confirm the command-line includes --profiling=false and does not contain --profiling=true or an unqualified --profiling flag.

Using kubectl

kubectl cannot change the --profiling flag because it is set in the static pod manifest on each control plane node. To remediate this finding, you must edit /etc/kubernetes/manifests/kube-apiserver.yaml directly on every control plane node as described in the Manual Steps section.

Automation
#!/usr/bin/env bash
#
# Disable kube-apiserver profiling by setting --profiling=false
# on every control plane node that runs the API server as a static pod.
#
# Run this on every control plane node with root privileges.

set -euo pipefail

APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"

echo "[INFO] Ensuring kube-apiserver profiling is disabled"

if [[ ! -f "${APISERVER_MANIFEST}" ]]; then
  echo "[ERROR] Manifest not found: ${APISERVER_MANIFEST}"
  echo "[ERROR] This script is intended for nodes using static pod manifests."
  exit 1
fi

# Create a backup once per day (idempotent enough for reruns)
BACKUP="${APISERVER_MANIFEST}.$(date +%F).bak"
if [[ ! -f "${BACKUP}" ]]; then
  cp "${APISERVER_MANIFEST}" "${BACKUP}"
  echo "[INFO] Backup created at ${BACKUP}"
else
  echo "[INFO] Backup for today already exists at ${BACKUP}"
fi

# Detect if an explicit --profiling flag exists
if grep -q -- '--profiling=' "${APISERVER_MANIFEST}"; then
  echo "[INFO] Existing --profiling flag found, enforcing --profiling=false"
  # Replace any value (true/false) with false, idempotently
  sed -i 's/--profiling=\(true\|false\)/--profiling=false/g' "${APISERVER_MANIFEST}"
else
  echo "[INFO] No --profiling flag found, adding --profiling=false to kube-apiserver args"
  # Add the flag under the args list for kube-apiserver
  # This assumes the manifest uses the common 'args:' list form.
  # The insertion is idempotent due to the grep check above.
  awk '
    $0 ~ /- kube-apiserver/ && seen == 0 {
      print
      seen=1
      next
    }
    seen == 1 && $0 ~ /^[[:space:]]*args:/ && added == 0 {
      print
      getline
      print
      # After first arg line, insert profiling flag with same indent as args items
      indent = gensub(/^([[:space:]]*)-.*/,"\\1","1",$0)
      print indent "- --profiling=false"
      added=1
      next
    }
    { print }
  ' "${APISERVER_MANIFEST}" > "${APISERVER_MANIFEST}.tmp"

  mv "${APISERVER_MANIFEST}.tmp" "${APISERVER_MANIFEST}"
fi

echo "[INFO] Change applied. kube-apiserver static pod will be restarted automatically by kubelet."

# Give kubelet some time to restart the pod
sleep 20

echo "[INFO] Verifying that kube-apiserver is running with --profiling=false"

# Verification: check running process flags
if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=false'; then
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=true'; then
    echo "[FAIL] Found both --profiling=true and --profiling=false in kube-apiserver process; manual review required."
    exit 2
  fi
  echo "[OK] kube-apiserver is running with --profiling=false on this control plane node."
  exit 0
else
  echo "[FAIL] kube-apiserver is not running with --profiling=false. Current process line(s):"
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true
  echo "[HINT] Check ${APISERVER_MANIFEST} for correct args and kubelet/service health."
  exit 3
fi

Additional Reading:​