> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Profiling Argument Is Set False

### More Info:

Disable profiling, if not needed.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, back up the API server static pod manifest:
           ```bash theme={null}
           sudo cp -a /etc/kubernetes/manifests/kube-apiserver.yaml /etc/kubernetes/manifests/kube-apiserver.yaml.bak
           ```

        2. On every control plane node, edit the manifest to ensure the `--profiling` flag is set to false in the kube-apiserver command:
           ```bash theme={null}
           sudo sed -i 's/--profiling=true/--profiling=false/' /etc/kubernetes/manifests/kube-apiserver.yaml
           ```
           If there is no existing `--profiling` flag, add `- --profiling=false` under the `command:` (or `args:`) list for `kube-apiserver` using a text editor such as:
           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```
           and add a line:
           ```yaml theme={null}
           - --profiling=false
           ```

        3. Wait for the kubelet on each control plane node to detect the manifest change and restart the `kube-apiserver` static pod (this happens automatically). You can monitor restart with:
           ```bash theme={null}
           sudo crictl ps | grep kube-apiserver || sudo docker ps | grep kube-apiserver
           ```

        4. On every control plane node, verify that the running kube-apiserver process includes `--profiling=false` and does not include `--profiling=true`:
           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep
           ```
      </Accordion>

      <Accordion title="Using kubectl">
        `kubectl` cannot modify the `kube-apiserver` static pod manifest or its process flags, so it cannot be used to set `--profiling=false`. To remediate this finding, you must edit `/etc/kubernetes/manifests/kube-apiserver.yaml` directly on every control plane node; see the Manual Steps section for the exact procedure.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Automation to enforce --profiling=false in /etc/kubernetes/manifests/kube-apiserver.yaml
        # Run this on every control plane node with root privileges.
        set -euo pipefail

        MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        BACKUP_DIR="/etc/kubernetes/manifests/backup-profiling-fix"
        TIMESTAMP="$(date +%Y%m%d%H%M%S)"

        if [[ $EUID -ne 0 ]]; then
          echo "ERROR: Run as root on each control plane node."
          exit 1
        fi

        if [[ ! -f "$MANIFEST" ]]; then
          echo "ERROR: kube-apiserver manifest not found at $MANIFEST"
          exit 1
        fi

        mkdir -p "$BACKUP_DIR"
        cp -a "$MANIFEST" "$BACKUP_DIR/kube-apiserver.yaml.$TIMESTAMP"

        # Ensure a --profiling flag is present and set to false.
        # Handles three cases idempotently:
        # 1) Flag already set to false       -> no change
        # 2) Flag set to true or other      -> updated to false
        # 3) Flag missing                   -> appended to the kube-apiserver command line
        tmpfile="$(mktemp)"
        trap 'rm -f "$tmpfile"' EXIT

        awk '
        /^- .*kube-apiserver(\s|$)/ {
          in_cmd=1
        }
        in_cmd && /--profiling=/ {
          sub(/--profiling=[^[:space:]]+/, "--profiling=false")
          found=1
        }
        { print }
        END {
          if (in_cmd && !found) {
            print "    - --profiling=false"
          }
        }
        ' "$MANIFEST" > "$tmpfile"

        # Only overwrite if there is a change
        if ! diff -q "$MANIFEST" "$tmpfile" >/dev/null 2>&1; then
          mv "$tmpfile" "$MANIFEST"
          echo "Updated $MANIFEST with --profiling=false. kube-apiserver static pod will restart automatically."
        else
          echo "No changes required; --profiling=false already enforced."
          rm -f "$tmpfile"
        fi

        # Verification: confirm kube-apiserver is running with --profiling=false
        echo "Waiting up to 60s for kube-apiserver to reflect new arguments..."
        for i in {1..12}; do
          if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- '--profiling=false'; then
            echo "SUCCESS: kube-apiserver is running with --profiling=false:"
            /bin/ps -ef | grep kube-apiserver | grep -v grep
            exit 0
          fi
          sleep 5
        done

        echo "WARNING: kube-apiserver process not yet showing --profiling=false. Current processes:"
        /bin/ps -ef | grep kube-apiserver | grep -v grep
        exit 1
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)