Skip to main content

Ensure Profiling Argument Is Set False

More Info:​

Disable profiling, if not needed.

Risk Level​

Medium

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, back up the API server static pod manifest:

    sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak

  2. On every control plane node, edit the manifest to ensure the --profiling flag is set to false in the kube-apiserver command:

    sudo sed -i 's/--profiling=true/--profiling=false/' /etc/kubernetes/manifests/kube-apiserver.yaml

    If there is no existing --profiling flag, add - --profiling=false under the command: (or args:) list for kube-apiserver using a text editor such as:

    sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

    and add a line:

    - --profiling=false

  3. Wait for the kubelet on each control plane node to detect the manifest change and restart the kube-apiserver static pod (this happens automatically). You can monitor restart with:

    sudo crictl ps | grep kube-apiserver || sudo docker ps | grep kube-apiserver

  4. On every control plane node, verify that the running kube-apiserver process includes --profiling=false and does not include --profiling=true:

    /bin/ps -ef | grep kube-apiserver | grep -v grep
Using kubectl

kubectl cannot modify the kube-apiserver static pod manifest or its process flags, so it cannot be used to set --profiling=false. To remediate this finding, you must edit /etc/kubernetes/manifests/kube-apiserver.yaml directly on every control plane node; see the Manual Steps section for the exact procedure.

Automation
#!/usr/bin/env bash
#
# Automation to enforce --profiling=false in /etc/kubernetes/manifests/kube-apiserver.yaml
# Run this on every control plane node with root privileges.
set -euo pipefail

MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
BACKUP_DIR="/etc/kubernetes/manifests/backup-profiling-fix"
TIMESTAMP="$(date +%Y%m%d%H%M%S)"

if [[ $EUID -ne 0 ]]; then
  echo "ERROR: Run as root on each control plane node."
  exit 1
fi

if [[ ! -f "$MANIFEST" ]]; then
  echo "ERROR: kube-apiserver manifest not found at $MANIFEST"
  exit 1
fi

mkdir -p "$BACKUP_DIR"
cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

# Ensure a --profiling flag is present and set to false.
# Handles three cases idempotently:
# 1) Flag already set to false       -> no change
# 2) Flag set to true or other      -> updated to false
# 3) Flag missing                   -> appended to the kube-apiserver command line
tmpfile="$(mktemp)"
trap 'rm -f "$tmpfile"' EXIT

awk '
/^- .*kube-apiserver(\s|$)/ {
  in_cmd=1
}
in_cmd && /--profiling=/ {
  sub(/--profiling=[^[:space:]]+/, "--profiling=false")
  found=1
}
{ print }
END {
  if (in_cmd && !found) {
    print "    - --profiling=false"
  }
}
' "$MANIFEST" > "$tmpfile"

# Only overwrite if there is a change
if ! diff -q "$MANIFEST" "$tmpfile" >/dev/null 2>&1; then
  mv "$tmpfile" "$MANIFEST"
  echo "Updated $MANIFEST with --profiling=false. kube-apiserver static pod will restart automatically."
else
  echo "No changes required; --profiling=false already enforced."
  rm -f "$tmpfile"
fi

# Verification: confirm kube-apiserver is running with --profiling=false
echo "Waiting up to 60s for kube-apiserver to reflect new arguments..."
for i in {1..12}; do
  if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=false'; then
    echo "SUCCESS: kube-apiserver is running with --profiling=false:"
    /bin/ps -ef | grep kube-apiserver | grep -v grep
    exit 0
  fi
  sleep 5
done

echo "WARNING: kube-apiserver process not yet showing --profiling=false. Current processes:"
/bin/ps -ef | grep kube-apiserver | grep -v grep
exit 1

Additional Reading:​