> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Controller Profiling Argument Is False

### More Info:

Disable profiling, if not needed.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, open the kube-controller-manager static pod manifest for editing:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml
           ```

        2. In the `spec.containers[0].command` (or `args`) list, add or modify the profiling flag so it is explicitly disabled. Ensure there is only one `--profiling` entry and it is set to `false`, for example:
           ```yaml theme={null}
           - --profiling=false
           ```
           Remove or correct any existing `--profiling=true`.

        3. Save the file and exit the editor. Because this is a static pod manifest under `/etc/kubernetes/manifests`, the kubelet on the control plane node will automatically restart the `kube-controller-manager` pod to apply the new setting. This causes a brief restart of the controller-manager component.

        4. Wait for the `kube-controller-manager` pod to be recreated and running:
           ```bash theme={null}
           sudo crictl ps | grep kube-controller-manager
           ```
           or, from any machine with `kubectl` access:
           ```bash theme={null}
           kubectl -n kube-system get pods -l component=kube-controller-manager
           ```

        5. On every control plane node, verify that the controller-manager process is now running with `--profiling=false`:
           ```bash theme={null}
           ps -ef | grep kube-controller-manager | grep -v grep
           ```
           Confirm the command-line includes `--profiling=false` and does not contain `--profiling=true` or an unqualified `--profiling` flag.
      </Accordion>

      <Accordion title="Using kubectl">
        `kubectl` cannot change the `--profiling` flag because it is set in the static pod manifest on each control plane node. To remediate this finding, you must edit `/etc/kubernetes/manifests/kube-apiserver.yaml` directly on every control plane node as described in the Manual Steps section.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Disable kube-apiserver profiling by setting --profiling=false
        # on every control plane node that runs the API server as a static pod.
        #
        # Run this on every control plane node with root privileges.

        set -euo pipefail

        APISERVER_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"

        echo "[INFO] Ensuring kube-apiserver profiling is disabled"

        if [[ ! -f "${APISERVER_MANIFEST}" ]]; then
          echo "[ERROR] Manifest not found: ${APISERVER_MANIFEST}"
          echo "[ERROR] This script is intended for nodes using static pod manifests."
          exit 1
        fi

        # Create a backup once per day (idempotent enough for reruns)
        BACKUP="${APISERVER_MANIFEST}.$(date +%F).bak"
        if [[ ! -f "${BACKUP}" ]]; then
          cp "${APISERVER_MANIFEST}" "${BACKUP}"
          echo "[INFO] Backup created at ${BACKUP}"
        else
          echo "[INFO] Backup for today already exists at ${BACKUP}"
        fi

        # Detect if an explicit --profiling flag exists
        if grep -q -- '--profiling=' "${APISERVER_MANIFEST}"; then
          echo "[INFO] Existing --profiling flag found, enforcing --profiling=false"
          # Replace any value (true/false) with false, idempotently
          sed -i 's/--profiling=\(true\|false\)/--profiling=false/g' "${APISERVER_MANIFEST}"
        else
          echo "[INFO] No --profiling flag found, adding --profiling=false to kube-apiserver args"
          # Add the flag under the args list for kube-apiserver
          # This assumes the manifest uses the common 'args:' list form.
          # The insertion is idempotent due to the grep check above.
          awk '
            $0 ~ /- kube-apiserver/ && seen == 0 {
              print
              seen=1
              next
            }
            seen == 1 && $0 ~ /^[[:space:]]*args:/ && added == 0 {
              print
              getline
              print
              # After first arg line, insert profiling flag with same indent as args items
              indent = gensub(/^([[:space:]]*)-.*/,"\\1","1",$0)
              print indent "- --profiling=false"
              added=1
              next
            }
            { print }
          ' "${APISERVER_MANIFEST}" > "${APISERVER_MANIFEST}.tmp"

          mv "${APISERVER_MANIFEST}.tmp" "${APISERVER_MANIFEST}"
        fi

        echo "[INFO] Change applied. kube-apiserver static pod will be restarted automatically by kubelet."

        # Give kubelet some time to restart the pod
        sleep 20

        echo "[INFO] Verifying that kube-apiserver is running with --profiling=false"

        # Verification: check running process flags
        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=false'; then
          if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=true'; then
            echo "[FAIL] Found both --profiling=true and --profiling=false in kube-apiserver process; manual review required."
            exit 2
          fi
          echo "[OK] kube-apiserver is running with --profiling=false on this control plane node."
          exit 0
        else
          echo "[FAIL] kube-apiserver is not running with --profiling=false. Current process line(s):"
          /bin/ps -ef | grep kube-apiserver | grep -v grep || true
          echo "[HINT] Check ${APISERVER_MANIFEST} for correct args and kubelet/service health."
          exit 3
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-controller-manager/](https://kubernetes.io/docs/admin/kube-controller-manager/)