Project: KICS (Provisioning / Security & Compliance)
File: 46a2e9ec-6a5f-4faa-9d39-4ea44d5d87a2.md

title: Bind Address Not Properly Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 46a2e9ec-6a5f-4faa-9d39-4ea44d5d87a2 Query name: Bind Address Not Properly Set Platform: Kubernetes Severity: <span style="color:#5bc0de">Info</span> Category: Networking and Firewall URL: When using kube-controller-manager or kube-scheduler commands, the '--bind-address' should be set to 127.0.0.1<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager","--bind-address=0.0.0.0"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="20" apiVersion: v1 kind: Pod metadata: labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: selector: matchLabels: app: kube-controller-manager template: metadata: labels: app: kube-controller-manager containers: name: command-demo-container image: k8s.gcr.io/kube-scheduler:v1.19.0 command: ["kube-scheduler"] args: [] restartPolicy: OnFailure ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="20" apiVersion: v1 kind: Pod metadata: labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: selector: matchLabels: app: kube-controller-manager template: metadata: labels: app: kube-controller-manager containers: name: command-demo-container image: k8s.gcr.io/kube-scheduler:v1.19.0 command: ["kube-scheduler","--bind-address=0.0.0.0"] args: [] restartPolicy: OnFailure ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager"] args: ["--bind-address=127.0.0.1"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0 command: ["kube-controller-manager","--bind-address=127.0.0.1"] args: [] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: v1 kind: Pod metadata: labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: selector: matchLabels: app: kube-controller-manager template: metadata: labels: app: kube-controller-manager containers: name: command-demo-container image: k8s.gcr.io/kube-scheduler:v1.19.0 command: ["kube-scheduler"] args: ["--bind-address=127.0.0.1"] restartPolicy: OnFailure ``` <details><summary>Negative test num. 4 - yaml file</summary> ```yaml apiVersion: v1 kind: Pod metadata: labels: component: kube-scheduler tier: control-plane name: kube-scheduler namespace: kube-system spec: selector: matchLabels: app: kube-controller-manager template: metadata: labels: app: kube-controller-manager containers: name: command-demo-container image: k8s.gcr.io/kube-scheduler:v1.19.0 command: ["kube-scheduler","--bind-address=127.0.0.1"] args: [] restartPolicy: OnFailure ``` </details>