API server pod has profiling disabled (--profiling=false)

​

What this check verifies

Kubernetes API server runtime profiling is controlled by the --profiling flag. The evaluation inspects API server container arguments to confirm --profiling=false and that profiling endpoints (such as /debug/pprof) are not enabled.

​

Risk

With profiling enabled, /debug/pprof exposes stack traces, heap data, and request details that can leak secrets and topology, degrading confidentiality. Heavy profiling queries can exhaust CPU and memory, threatening availability. Insight into code paths and timings can aid exploitation, affecting integrity of the control plane.

​

Recommendation

Keep API server profiling disabled by default. If diagnostics are required, enable it briefly in a controlled, isolated environment. Apply least privilege to debug access, restrict exposure via network controls, and audit usage. Use defense in depth and separation of duties for any profiling enablement.

​

Remediation

Dashboard steps

1. SSH to the control plane node
2. Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3. In spec.containers[0].command, add: --profiling=false
4. Save the file; the kubelet will restart the API server automatically
5. Verify the flag is active: ps aux | grep kube-apiserver | grep -- '--profiling=false'

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_disable_profiling. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks