Repository: karmada-io/website
Pull request #813: Add binding address configuration for security considerations
Author: login: XiShanYongYe-Chang
Labels: name: kind/documentation
description: Categorizes issue or PR as related to documentation.
name: approved
description: Indicates a PR has been approved by an approver from all required OWNERS files.
name: lgtm
description: Indicates that a PR is ready to be merged.
name: size/L
description: Denotes a PR that changes 100-499 lines, ignoring generated files.
Created: 2025-03-21T09:00:40Z | Merged: 2025-03-27T03:59:46Z

**What type of PR is this?**

/kind documentation
<!--
Add one of the following kinds:

/kind bug
/kind cleanup
/kind design
/kind documentation
/kind failing-test
/kind feature
/kind flake

-->

**What this PR does / why we need it**:

Karmada components provide users with listening addresses that can be configured for services such as business operations or health checks. To make it more convenient for users to centrally understand this configuration information, we have provided an explanation in the security considerations document.  

**Which issue(s) this PR fixes**:
Fixes #

**Special notes for your reviewer**:





Diff:
diff --git a/docs/administrator/security/security-considerations.md b/docs/administrator/security/security-considerations.md
index 06a48433..430ce35c 100644
--- a/docs/administrator/security/security-considerations.md
+++ b/docs/administrator/security/security-considerations.md
@@ -30,3 +30,69 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components provide configurable parameters for users to configure listening addresses and ports. When a user deploys a Karmada component, the Karmada component will use the default listening address and port if the listening-related parameters are not configured. The default listening address of the Karmada component is `0.0.0.0`, which means that the component will listen to all network interfaces on the server (for a container, this is a virtual network interface that is managed by the container runtime, such as Docker).
+
+The following are the configurable parameters provided by the Karmada component:
+
+- karmada-controller-manager
+    - `--metrics-bind-address`: default is `:8080`.
+    - `--health-probe-bind-address`: default is `:10357`.
+- karmada-scheduler
+    - `--metrics-bind-address`: default is `:8080`.
+    - `--health-probe-bind-address`: default is `:10351`.
+- karmada-scheduler-estimator
+    - `--metrics-bind-address`: default is `:8080`.
+    - `--health-probe-bind-address`: default is `:10351`.
+- karmada-descheduler
+    - `--metrics-bind-address`: default is `:8080`.
+    - `--health-probe-bind-address`: default is `:10358`.
+- karmada-aggregated-apiserver
+    - `--bind-address`: default is `0.0.0.0`.
+    - `--secure-port`: default is `443`.
+- karmada-metrics-adapter
+    - `--metrics-bind-address`: default is `:8080`.
+    - `--bind-address`: default is `0.0.0.0`.
+    - `--secure-port`: default is `443`.
+- karmada-webhook
+    - `--metrics-bind-address`: default is `:8080`.
+    - `--health-probe-bind-address`: default is `:8000`.
+    - `--bind-address`: default is `0.0.0.0`.
+    - `--secure-port`: default is `8443`.
+- karmada-search
+    - `--bind-address`: default is `0.0.0.0`.
+    - `--secure-port`: default is `443`.
+- karmada-agent
+    - `--metrics-bind-address`: default is `:8080`.
+    - `--health-probe-bind-address`: default is `:10357`.
+
+Users can configure the listening address as a Pod IP value. For example, you can configure the metrics interface of the `karmada-controller-manager` component as follows:
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: karmada-controller-manager
+  namespace: karmada-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: karmada-controller-manager
+  template:
+    metadata:
+      labels:
+        app: karmada-controller-manager
+    spec:
+      containers:
+      - name: my-container
+        env:
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        command:
+        - /bin/karmada-controller-manager
+        - --metrics-bind-address=${POD_IP}:8080
+```
diff --git a/i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md b/i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md
index f018050a..5d84383a 100644
--- a/i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md
+++ b/i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md
@@ -30,3 +30,69 @@ Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设
 
 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。
 
+#### 绑定地址配置
+
+Karmada 各组件为用户配置监听地址和端口提供了可配置的参数。当用户部署 Karmada 组件时，若未配置监听相关参数时，Karmada 组件会使用默认的监听地址和端口。Karmada 组件默认监听地址为 `0.0.0.0` ，这意味着该组件将监听服务器上的所有网络接口（对于容器来说，这是一个虚拟网络接口，由容器运行时管理，如 Docker）。
+
+以下是 Karmada 组件提供的可配置参数：
+
+- karmada-controller-manager
+    - `--metrics-bind-address`：默认值为 `:8080`。
+    - `--health-probe-bind-address`：默认值为 `:10357`。
+- karmada-scheduler
+    - `--metrics-bind-address`：默认值为 `:8080`。
+    - `--health-probe-bind-address`：默认值为 `:10351`。
+- karmada-scheduler-estimator
+    - `--metrics-bind-address`：默认值为 `:8080`。
+    - `--health-probe-bind-address`：默认值为 `:10351`。
+- karmada-descheduler
+    - `--metrics-bind-address`：默认值为 `:8080`。
+    - `--health-probe-bind-address`：默认值为 `:10358`。
+- karmada-aggregated-apiserver
+    - `--bind-address`：默认值为 `0.0.0.0`。
+    - `--secure-port`：默认值为 `443`。
+- karmada-metrics-adapter
+    - `--metrics-bind-address`：默认值为 `:8080`。
+    - `--bind-address`：默认值为 `0.0.0.0`。
+    - `--secure-port`：默认值为 `443`。
+- karmada-webhook
+    - `--metrics-bind-address`：默认值为 `:8080`。
+    - `--health-probe-bind-address`：默认值为 `:8000`。
+    - `--bind-address`：默认值为 `0.0.0.0`。
+    - `--secure-port`：默认值为 `8443`。
+- karmada-search
+    - `--bind-address`：默认值为 `0.0.0.0`。
+    - `--secure-port`：默认值为 `443`。
+- karmada-agent
+    - `--metrics-bind-address`：默认值为 `:8080`。
+    - `--health-probe-bind-address`：默认值为 `:10357`。
+
+用户可以将监听地址配置为 Pod IP 值。 例如，您可以按照以下方式配置 `karmada-controller-manager` 组件的 `metrics` 接口：
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: karmada-controller-manager
+  namespace: karmada-system
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: karmada-controller-manager
+  template:
+    metadata:
+      labels:
+        app: karmada-controller-manager
+    spec:
+      containers:
+      - name: my-container
+        env:
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        command:
+        - /bin/karmada-controller-manager
+        - --metrics-bind-address=${POD_IP}:8080
+```


Reviews:
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR updates the security considerations documentation to explain the configuration of binding addresses for Karmada components, emphasizing security by allowing configuration of listening addresses and ports. Key changes include:
- Adding a new "Binding Address Configuration" section in the English documentation.
- Translating the new section into Chinese.
- Including a usage example for configuring the pod IP for the metrics interface.

### Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

| File | Description |
| ---- | ----------- |
| docs/administrator/security/security-considerations.md | Added section detailing binding address configuration and usage example. |
| i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md | Added translated section and usage example for binding address configuration. |


<details>
<summary>Comments suppressed due to low confidence (3)</summary>

**docs/administrator/security/security-considerations.md:39**
* Component name 'karmada-controller-manage' appears to be a typo. Consider updating it to 'karmada-controller-manager' to match the example below.
```
- karmada-controller-manage
```
**i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md:39**
* 组件名称 'karmada-controller-manage' 存在笔误，建议更正为 'karmada-controller-manager' 以与示例保持一致。
```
- karmada-controller-manage
```
**i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md:62**
* [nitpick] 标点符号不一致：建议在这一行末尾添加句号以保持与其他条目的风格一致。
```
    - `--secure-port`：默认值为 `8443`
```
</details>


state: COMMENTED
author_association: NONE
submitted_at: 2025-03-21T09:44:17Z
user: login: RainbowMango
body: /assign
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-24T12:17:39Z
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR enhances the security considerations documentation by adding detailed guidance on configuring binding addresses for Karmada components.  
- Adds a new section explaining the security implications of using the default 0.0.0.0 address.  
- Provides component-specific recommendations and a YAML example for configuring the pod IP for metrics.

### Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

| File | Description |
| ---- | ----------- |
| docs/administrator/security/security-considerations.md | Added a new "Binding Address Configuration" section with configuration recommendations and example YAML. |
| i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md | Updated Chinese version of the security considerations with the binding address configuration details. |


<details>
<summary>Comments suppressed due to low confidence (2)</summary>

**docs/administrator/security/security-considerations.md:41**
* The component name 'karmada-controller-manage' appears to be a typo; consider renaming it to 'karmada-controller-manager' to match the YAML example.
```
- karmada-controller-manage
```
**i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md:37**
* The component name 'karmada-controller-manage' appears to be a typo; consider renaming it to 'karmada-controller-manager' for consistency with the rest of the document.
```
- karmada-controller-manage
```
</details>


state: COMMENTED
author_association: NONE
submitted_at: 2025-03-24T12:17:52Z
user: login: RainbowMango
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-24T12:31:55Z
user: login: RainbowMango
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-24T12:33:27Z
user: login: XiShanYongYe-Chang
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-24T12:36:43Z
user: login: XiShanYongYe-Chang
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-24T12:38:12Z
user: login: XiShanYongYe-Chang
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-24T12:41:11Z
user: login: XiShanYongYe-Chang
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-24T12:52:05Z
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR updates the security considerations documentation by adding a new section that explains the configurable binding address parameters for Karmada components, thereby improving clarity on component listening addresses for both Chinese and English documentation.  
- Added new "绑定地址配置" section in the Chinese docs  
- Added new "Binding Address Configuration" section in the English docs

### Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

| File | Description |
| ---- | ----------- |
| i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md | Added explanation for binding address configuration in Chinese |
| docs/administrator/security/security-considerations.md | Added explanation for binding address configuration in English |


<details>
<summary>Comments suppressed due to low confidence (2)</summary>

**i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md:39**
* The component name 'karmada-controller-manage' appears to be a typo. To maintain consistency with the deployment example, consider renaming it to 'karmada-controller-manager'.
```
- karmada-controller-manage
```
**docs/administrator/security/security-considerations.md:39**
* The component name 'karmada-controller-manage' appears to be a typo. To maintain consistency with the deployment example, consider renaming it to 'karmada-controller-manager'.
```
- karmada-controller-manage
```
</details>


state: COMMENTED
author_association: NONE
submitted_at: 2025-03-26T13:27:10Z
user: login: RainbowMango
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-26T13:28:48Z
user: login: XiShanYongYe-Chang
state: COMMENTED
author_association: MEMBER
submitted_at: 2025-03-27T01:17:48Z
user: login: RainbowMango
body: /lgtm
/approve
state: APPROVED
author_association: MEMBER
submitted_at: 2025-03-27T03:58:53Z

Review comments:
diff_hunk: @@ -30,3 +30,69 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
+
+From a security standpoint, this is not recommended. Karmada components provide configurable parameters for users to configure listening address. In addition, users can also configure the listening port.
+
+- karmada-controller-manage
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10357`, you can configure this value as the pod IP.
+- karmada-scheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-scheduler-estimator
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-descheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10358`, you can configure this value as the pod IP.
+- karmada-aggregated-apiserver
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-metrics-adapter
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-webhook
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:8000`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `8443`
path: docs/administrator/security/security-considerations.md
user: login: Copilot
body: [nitpick] Inconsistent punctuation detected: consider adding a period at the end of this line for consistency with similar entries.
```suggestion
    - `--secure-port`: default is `8443`.
```
created_at: 2025-03-21T09:44:17Z
author_association: NONE
diff_hunk: @@ -30,3 +30,69 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
path: docs/administrator/security/security-considerations.md
user: login: RainbowMango
body: > on the server

What kind of server? Container or physical machine?
created_at: 2025-03-21T09:46:03Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,67 @@ Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设
 
 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。
 
+#### 绑定地址 Configuration
+
path: i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md
user: login: Copilot
body: [nitpick] Consider fully localizing the heading to '#### 绑定地址配置' instead of mixing Chinese and English.
```suggestion
#### 绑定地址配置
```
created_at: 2025-03-24T12:17:52Z
author_association: NONE
diff_hunk: @@ -30,3 +30,71 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
+
+From a security standpoint, this is not recommended. Karmada components provide configurable parameters for users to configure listening address. In addition, users can also configure the listening port.
path: docs/administrator/security/security-considerations.md
user: login: RainbowMango
body: > From a security standpoint, this is not recommended.

What does `this` do you mean? It seems like the thing `Karmada components listen on the `0.0.0.0` IP address by default`
created_at: 2025-03-24T12:31:54Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,71 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
+
+From a security standpoint, this is not recommended. Karmada components provide configurable parameters for users to configure listening address. In addition, users can also configure the listening port.
+
+Karmada components provide configurable parameters for users to configure listening addresses and ports. When a user deploys a Karmada component, the Karmada component will use the default listening address and port if the listening-related parameters are not configured. The default listening address of the Karmada component is `0.0.0.0`, which means that the component will listen to all network interfaces on the server. Users can configure as follows:
+
+- karmada-controller-manage
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10357`, you can configure this value as the pod IP.
+- karmada-scheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-scheduler-estimator
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-descheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10358`, you can configure this value as the pod IP.
+- karmada-aggregated-apiserver
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-metrics-adapter
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-webhook
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:8000`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `8443`.
+- karmada-search
path: docs/administrator/security/security-considerations.md
user: login: RainbowMango
body: > you can configure this value as the pod IP

Do not need to repeat so many times given the only choice is using the pod IP.
created_at: 2025-03-24T12:33:27Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,69 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
path: docs/administrator/security/security-considerations.md
user: login: XiShanYongYe-Chang
body: For a container, this is a virtual network interface that is managed by the container runtime (such as Docker).
created_at: 2025-03-24T12:36:43Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,71 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
+
+From a security standpoint, this is not recommended. Karmada components provide configurable parameters for users to configure listening address. In addition, users can also configure the listening port.
path: docs/administrator/security/security-considerations.md
user: login: XiShanYongYe-Chang
body: Sorry, I forgot to clean it up. It's old.
created_at: 2025-03-24T12:38:12Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,71 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
+
+From a security standpoint, this is not recommended. Karmada components provide configurable parameters for users to configure listening address. In addition, users can also configure the listening port.
+
+Karmada components provide configurable parameters for users to configure listening addresses and ports. When a user deploys a Karmada component, the Karmada component will use the default listening address and port if the listening-related parameters are not configured. The default listening address of the Karmada component is `0.0.0.0`, which means that the component will listen to all network interfaces on the server. Users can configure as follows:
+
+- karmada-controller-manage
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10357`, you can configure this value as the pod IP.
+- karmada-scheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-scheduler-estimator
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-descheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10358`, you can configure this value as the pod IP.
+- karmada-aggregated-apiserver
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-metrics-adapter
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-webhook
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:8000`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `8443`.
+- karmada-search
path: docs/administrator/security/security-considerations.md
user: login: XiShanYongYe-Chang
body: Okay, Let me find a place to sum up
created_at: 2025-03-24T12:41:11Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,71 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components listen on the `0.0.0.0` IP address by default, which means that the component will listen on all network interfaces on the server.
+
+From a security standpoint, this is not recommended. Karmada components provide configurable parameters for users to configure listening address. In addition, users can also configure the listening port.
+
+Karmada components provide configurable parameters for users to configure listening addresses and ports. When a user deploys a Karmada component, the Karmada component will use the default listening address and port if the listening-related parameters are not configured. The default listening address of the Karmada component is `0.0.0.0`, which means that the component will listen to all network interfaces on the server. Users can configure as follows:
+
+- karmada-controller-manage
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10357`, you can configure this value as the pod IP.
+- karmada-scheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-scheduler-estimator
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10351`, you can configure this value as the pod IP.
+- karmada-descheduler
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:10358`, you can configure this value as the pod IP.
+- karmada-aggregated-apiserver
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-metrics-adapter
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `443`.
+- karmada-webhook
+    - `--metrics-bind-address`: default is `:8080`, you can configure this value as the pod IP.
+    - `--health-probe-bind-address`: default is `:8000`, you can configure this value as the pod IP.
+    - `--bind-address`: default is `0.0.0.0`, you can configure this value as the pod IP.
+    - `--secure-port`: default is `8443`.
+- karmada-search
path: docs/administrator/security/security-considerations.md
user: login: XiShanYongYe-Chang
body: Done.
created_at: 2025-03-24T12:52:05Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,69 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components provide configurable parameters for users to configure listening addresses and ports. When a user deploys a Karmada component, the Karmada component will use the default listening address and port if the listening-related parameters are not configured. The default listening address of the Karmada component is `0.0.0.0`, which means that the component will listen to all network interfaces on the server (for a container, this is a virtual network interface that is managed by the container runtime, such as Docker).
+
+The following are the configurable parameters provided by the Karmada component:
+
+- karmada-controller-manage
path: docs/administrator/security/security-considerations.md
user: login: RainbowMango
body: ```suggestion
- karmada-controller-manager
```
created_at: 2025-03-26T13:28:17Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,69 @@ Karmada 各组件通过启动参数`--tls-min-version`和`--cipher-suites`来设
 
 其中，将 Golang 的`secure cipher suites`设置为 etcd 的`cipher suites`。与 k8s 默认`cipher suites`的首选值一致。
 
+#### 绑定地址配置
+
+Karmada 各组件为用户配置监听地址和端口提供了可配置的参数。当用户部署 Karmada 组件时，若未配置监听相关参数时，Karmada 组件会使用默认的监听地址和端口。Karmada 组件默认监听地址为 `0.0.0.0` ，这意味着该组件将监听服务器上的所有网络接口（对于容器来说，这是一个虚拟网络接口，由容器运行时管理，如 Docker）。
+
+以下是 Karmada 组件提供的可配置参数：
+
+- karmada-controller-manage
path: i18n/zh/docusaurus-plugin-content-docs/current/administrator/security/security-considerations.md
user: login: RainbowMango
body: ```suggestion
- karmada-controller-manager
```
created_at: 2025-03-26T13:28:28Z
author_association: MEMBER
diff_hunk: @@ -30,3 +30,69 @@ To avoid the use of insecure algorithms such as 3DES during the communication pr
 
 Set Golang's secure cipher suite to etcd's cipher suite. They are obtained through the return value of the function "CipherSuites()" under the "go/src/crypto/tls/cipher_suites.go" package. Consistent with the "preferred value" of the k8s default cipher suite.
 
+#### Binding Address Configuration
+
+Karmada components provide configurable parameters for users to configure listening addresses and ports. When a user deploys a Karmada component, the Karmada component will use the default listening address and port if the listening-related parameters are not configured. The default listening address of the Karmada component is `0.0.0.0`, which means that the component will listen to all network interfaces on the server (for a container, this is a virtual network interface that is managed by the container runtime, such as Docker).
+
+The following are the configurable parameters provided by the Karmada component:
+
+- karmada-controller-manage
path: docs/administrator/security/security-considerations.md
user: login: XiShanYongYe-Chang
body: thx~
created_at: 2025-03-27T01:17:48Z
author_association: MEMBER

PR comments:
user: login: XiShanYongYe-Chang
created_at: 2025-03-24T03:03:35Z
body: /cc @RainbowMango 
author_association: MEMBER
user: login: karmada-bot
created_at: 2025-03-27T03:58:59Z
body: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/karmada-io/website/pull/813#pullrequestreview-2719469977" title="Approved">RainbowMango</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=karmada-io%2Fwebsite).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[docs/OWNERS](https://github.com/karmada-io/website/blob/main/docs/OWNERS)~~ [RainbowMango]
- ~~[i18n/OWNERS](https://github.com/karmada-io/website/blob/main/i18n/OWNERS)~~ [RainbowMango]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
author_association: CONTRIBUTOR