Skip to main content

Ensure Bind Address Argument Is 127.0.0.1

More Info:​

Do not bind the scheduler service to non-loopback insecure addresses.

Risk Level​

Critical

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, open the kube-scheduler static pod manifest for editing:

    sudo vi /etc/kubernetes/manifests/kube-scheduler.yaml

  2. In the spec.containers[0].command (or args) section, locate any existing --bind-address flag. If present and not 127.0.0.1, change it to:

    - --bind-address=127.0.0.1

  3. If no --bind-address flag exists, add it under the scheduler container’s command/args list, for example:

    spec:
      containers:
        - name: kube-scheduler
          command:
            - kube-scheduler
            - --bind-address=127.0.0.1
            ...

  4. Save the file and exit the editor. The kube-scheduler static pod will be automatically restarted by the kubelet because /etc/kubernetes/manifests/kube-scheduler.yaml changed. Allow 10–20 seconds for it to restart.

  5. On the same control plane node, verify the running kube-scheduler process is using the correct bind address:

    /bin/ps -ef | grep kube-scheduler | grep -v grep

  6. Confirm in the output that the kube-scheduler command line includes:

    --bind-address=127.0.0.1

    and that there is no conflicting --bind-address with a different value. Repeat all steps on every control plane node.

Using kubectl

kubectl cannot change the bind address for the kube-controller-manager or kube-scheduler because this setting is defined in the static pod manifest on each control plane node (for example, /etc/kubernetes/manifests/kube-controller-manager.yaml or /etc/kubernetes/manifests/kube-scheduler.yaml). To remediate this finding, follow the guidance in the Manual Steps section and edit the manifest directly on every control plane node.

Automation
#!/usr/bin/env bash
#
# Automation: Ensure kube-scheduler --bind-address is set to 127.0.0.1
#
# Run on: every control plane node (with root privileges).
# Effect: Editing /etc/kubernetes/manifests/kube-scheduler.yaml will
#         trigger a restart of the kube-scheduler static pod via kubelet.

set -euo pipefail

SCHEDULER_MANIFEST="/etc/kubernetes/manifests/kube-scheduler.yaml"
TMP_MANIFEST="/tmp/kube-scheduler.yaml.$$"

echo "[*] Checking for kube-scheduler manifest at ${SCHEDULER_MANIFEST}"
if [[ ! -f "${SCHEDULER_MANIFEST}" ]]; then
  echo "[!] kube-scheduler manifest not found at ${SCHEDULER_MANIFEST}. Nothing to do on this node."
  exit 0
fi

cp "${SCHEDULER_MANIFEST}" "${TMP_MANIFEST}"

echo "[*] Ensuring --bind-address=127.0.0.1 is present and correct in kube-scheduler manifest"

# Normalize any existing --bind-address argument to 127.0.0.1 inside the manifest
# Works whether the arg is formatted with or without quotes.
perl -pi -e '
  if (/--bind-address=/) {
    s/--bind-address=\S+/--bind-address=127.0.0.1/;
  }
' "${TMP_MANIFEST}"

# If no --bind-address arg exists, add it explicitly to the command args list.
# This assumes a standard static pod manifest structure.
if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then
  echo "[*] --bind-address not found; adding --bind-address=127.0.0.1 to kube-scheduler args"

  # Try to inject into an existing args list (YAML array form).
  if grep -q '^\s*args:\s*$' "${TMP_MANIFEST}"; then
    perl -0pi -e '
      s/(^\s*args:\s*\n)((\s*-\s+.*\n)+)/$1$2\ \ - --bind-address=127.0.0.1\n/m
    ' "${TMP_MANIFEST}" || true
  fi

  # If still not present, try to append as a standalone command argument
  if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then
    # Fallback: append to the command array if present
    perl -0pi -e '
      s/(^\s*command:\s*\n)((\s*-\s+.*\n)+)/$1$2\ \ - --bind-address=127.0.0.1\n/m
    ' "${TMP_MANIFEST}" || true
  fi
fi

# Final safety check before overwriting
if ! grep -q -- "--bind-address=127.0.0.1" "${TMP_MANIFEST}"; then
  echo "[!] Failed to ensure --bind-address=127.0.0.1 in temporary manifest. Not modifying live manifest."
  rm -f "${TMP_MANIFEST}"
  exit 1
fi

echo "[*] Updating ${SCHEDULER_MANIFEST} (this will restart the kube-scheduler static pod)"
cp "${TMP_MANIFEST}" "${SCHEDULER_MANIFEST}"
chmod 600 "${SCHEDULER_MANIFEST}"
rm -f "${TMP_MANIFEST}"

echo "[*] Waiting for kube-scheduler process to restart with new arguments..."
sleep 10

echo "[*] Verification: checking kube-scheduler process arguments"
/bin/ps -ef | grep kube-scheduler | grep -v grep || {
  echo "[!] kube-scheduler process not found. Check kubelet and static pod status."
  exit 1
}

if /bin/ps -ef | grep kube-scheduler | grep -v grep | grep -q -- "--bind-address=127.0.0.1"; then
  echo "[+] kube-scheduler is running with --bind-address=127.0.0.1"
  exit 0
else
  echo "[!] kube-scheduler is NOT running with --bind-address=127.0.0.1. Please review ${SCHEDULER_MANIFEST} and kubelet logs."
  exit 1
fi

Additional Reading:​