Project: KICS (Provisioning / Security & Compliance)
File: 2f491173-6375-4a84-b28e-a4e2b9a58a69.md

title: Profiling Not Set To False hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 2f491173-6375-4a84-b28e-a4e2b9a58a69 Query name: Profiling Not Set To False Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: When using kube-apiserver or kube-controller-manager or kube-scheduler command, the '--profiling' flag should be defined and set to false<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--profiling=true"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo-1 labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="21" apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-master-3 namespace: kube-system spec: selector: matchLabels: app: kube-controller-manager template: metadata: labels: app: kube-controller-manager containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-master-3 command: ["kube-controller-manager","--profiling=true"] args: [] restartPolicy: OnFailure ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="21" apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-master-4 namespace: kube-system spec: selector: matchLabels: app: kube-controller-manager template: metadata: labels: app: kube-controller-manager containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-master-4 command: ["kube-controller-manager"] args: [] restartPolicy: OnFailure ``` </details> <details><summary>Positive test num. 5 - yaml file</summary> ```yaml hl_lines="2" apiVersion: kubescheduler.config.k8s.io/v1beta2 kind: KubeSchedulerConfiguration profiles: pluginConfig: args: scoringStrategy: resources: name: cpu weight: 1 type: MostAllocated name: NodeResourcesFit ``` </details> <details><summary>Positive test num. 6 - yaml file</summary> ```yaml hl_lines="3" apiVersion: kubescheduler.config.k8s.io/v1beta2 kind: KubeSchedulerConfiguration enableProfiling: true profiles: pluginConfig: args: scoringStrategy: resources: name: cpu weight: 1 type: MostAllocated name: NodeResourcesFit2 ``` </details> <details><summary>Positive test num. 7 - yaml file</summary> ```yaml hl_lines="14" apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-scheduler tier: control-plane name: kube-scheduler-master-2 namespace: kube-system spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-scheduler-master-2 command: ["kube-scheduler","--profiling=true"] args: [] restartPolicy: OnFailure ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--profiling=false"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-controller-manager tier: control-plane name: kube-controller-manager-master-1 namespace: kube-system spec: selector: matchLabels: app: kube-controller-manager template: metadata: labels: app: kube-controller-manager containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-master-1 command: ["kube-controller-manager","--profiling=false"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-scheduler tier: control-plane name: kube-scheduler-master-3 namespace: kube-system spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-scheduler-master-1 command: ["kube-scheduler","--profiling=false"] args: [] restartPolicy: OnFailure ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml apiVersion: kubescheduler.config.k8s.io/v1beta2 kind: KubeSchedulerConfiguration enableProfiling: false profiles: pluginConfig: args: scoringStrategy: resources: name: cpu weight: 1 type: MostAllocated name: NodeResourcesFit3 ``` </details> <details><summary>Negative test num. 5 - yaml file</summary> ```yaml apiVersion: v1 kind: Pod metadata: creationTimestamp: null labels: component: kube-scheduler tier: control-plane name: kube-scheduler-master-1 namespace: kube-system spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-scheduler-master-1 command: ["kube-scheduler"] args: [] restartPolicy: OnFailure ``` </details>