> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Controller Manager Bind Address Should Be 127.0.0.1 ### More Info: Verifies that the controller manager --bind-address is set to 127.0.0.1 so its metrics and health endpoints are not exposed on the network. ### Risk Level High ### Address Security ### Compliance Standards * CIS Kubernetes ### Triage and Remediation ### Remediation 1. On every control plane node, back up the existing manifest so you can roll back if needed: ```bash theme={null} sudo cp -a /etc/kubernetes/manifests/kube-controller-manager.yaml \ /etc/kubernetes/manifests/kube-controller-manager.yaml.bak ``` 2. Edit the controller manager static pod manifest on that control plane node: ```bash theme={null} sudo vi /etc/kubernetes/manifests/kube-controller-manager.yaml ``` 3. In the container command/args section, set or correct the bind address flag so it is exactly: ```yaml theme={null} - --bind-address=127.0.0.1 ``` Remove any other `--bind-address` entries with different values. Save and exit.\ Note: updating this static pod manifest will cause the kube-controller-manager pod to be restarted automatically by the kubelet. 4. Wait for the kube-controller-manager pod to restart and become Running on that node: ```bash theme={null} sudo crictl ps | grep kube-controller-manager || sudo docker ps | grep kube-controller-manager ``` (use whichever container runtime command is available on that node). 5. Repeat steps 1–4 on every other control plane node. 6. Verify on each control plane node that the controller manager is now running with the correct bind address: ```bash theme={null} /bin/ps -ef | grep kube-controller-manager | grep -v grep | grep -- '--bind-address=127.0.0.1' ``` kubectl cannot modify the kube-controller-manager static pod manifest or its process flags. This finding must be fixed directly on each control plane node by editing `/etc/kubernetes/manifests/kube-controller-manager.yaml`; see the Manual Steps section for exact host-level instructions. ```bash theme={null} #!/usr/bin/env bash # # Remediation: Ensure kube-controller-manager --bind-address is set to 127.0.0.1 # Scope: Run on every control plane node (with sudo/root). Safe to re-run. # set -euo pipefail MANIFEST="/etc/kubernetes/manifests/kube-controller-manager.yaml" BACKUP_DIR="/etc/kubernetes/manifests/backup-cis-1.3.7" REQUIRED_BIND="127.0.0.1" echo "==> Starting remediation for kube-controller-manager bind-address on host: $(hostname)" if [[ $EUID -ne 0 ]]; then echo "ERROR: This script must be run as root (or via sudo)." >&2 exit 1 fi if [[ ! -f "${MANIFEST}" ]]; then echo "ERROR: Manifest ${MANIFEST} not found on this node. Is this a control plane node?" >&2 exit 1 fi mkdir -p "${BACKUP_DIR}" TS="$(date +%Y%m%d-%H%M%S)" BACKUP_FILE="${BACKUP_DIR}/kube-controller-manager.yaml.${TS}" echo "==> Backing up ${MANIFEST} to ${BACKUP_FILE}" cp -p "${MANIFEST}" "${BACKUP_FILE}" echo "==> Ensuring --bind-address=${REQUIRED_BIND} in ${MANIFEST}" # This operation is idempotent: # - If --bind-address exists, update its value. # - If it does not exist, add it under the existing command list. # 1) If an existing --bind-address arg is present, replace its value if grep -q -- "--bind-address=" "${MANIFEST}"; then sed -i "s/--bind-address=[0-9]\{1,3\}\(\.[0-9]\{1,3\}\)\{3\}/--bind-address=${REQUIRED_BIND}/" "${MANIFEST}" else # 2) Append --bind-address argument under the kube-controller-manager container args/command # Try to append to an existing `- --bind-address` style list; if not present, we append a new line. # This assumes a standard kubeadm-style static pod manifest. if grep -q "kube-controller-manager" "${MANIFEST}"; then # Insert after the line containing "kube-controller-manager" container command/args list item awk -v bind="--bind-address=${REQUIRED_BIND}" ' /kube-controller-manager/ && in_container==0 { in_container=1 print $0 next } in_container==1 && $0 ~ /^ *- .*/ && inserted==0 { print $0 print " - " bind inserted=1 next } { print $0 } ' "${MANIFEST}" > "${MANIFEST}.tmp" || { echo "ERROR: Failed to update manifest; restoring backup." >&2 cp -p "${BACKUP_FILE}" "${MANIFEST}" exit 1 } mv "${MANIFEST}.tmp" "${MANIFEST}" else echo "WARNING: Could not confidently locate kube-controller-manager container section." echo "Appending bind-address line near the end of file; please review manually." echo " - --bind-address=${REQUIRED_BIND}" >> "${MANIFEST}" fi fi echo "==> Manifest updated. Kubelet will automatically restart the kube-controller-manager static pod." # Wait a short period for kubelet to recreate/reload the pod sleep 20 echo "==> Verifying that kube-controller-manager is running with --bind-address=${REQUIRED_BIND}" # Verification 1: process flags if /bin/ps -ef | grep kube-controller-manager | grep -v grep | grep -q -- "--bind-address=${REQUIRED_BIND}"; then echo "PASS: kube-controller-manager process shows --bind-address=${REQUIRED_BIND}" else echo "FAIL: kube-controller-manager process does NOT show --bind-address=${REQUIRED_BIND}" >&2 echo " Run: /bin/ps -ef | grep kube-controller-manager | grep -v grep" >&2 exit 1 fi # Verification 2: manifest content if grep -q -- "--bind-address=${REQUIRED_BIND}" "${MANIFEST}"; then echo "PASS: ${MANIFEST} contains --bind-address=${REQUIRED_BIND}" else echo "FAIL: ${MANIFEST} does NOT contain --bind-address=${REQUIRED_BIND}" >&2 exit 1 fi echo "==> Remediation complete on host: $(hostname)" ```