Check ID: controllermanager_bind_address
Provider: Kubernetes
Service: controllermanager
Severity: HIGH
Categories: cluster-security, internet-exposed
Resource type: Pod

​
What this check verifies

Kubernetes controller manager uses the loopback bind address 127.0.0.1 via --bind-address or --address, keeping its health, metrics, and debug endpoints reachable only from the host

​
Risk

Listening on a non-loopback address exposes health, metrics, and debug endpoints to the network, enabling control-plane reconnaissance and leakage of internal state. Heavy scraping or profiling can drive resource exhaustion, reducing control-plane availability and stability.

​
Recommendation

Bind to 127.0.0.1 and apply defense in depth:
  • Prefer local-only endpoints; avoid 0.0.0.0
  • Use TLS and authentication if exposure is unavoidable
  • Enforce network segmentation for control-plane access
  • Disable profiling when not needed; apply least privilege for telemetry

​
Remediation

Dashboard steps
  1. SSH to the control-plane node running the Controller Manager
  2. Edit the static Pod manifest: /etc/kubernetes/manifests/kube-controller-manager.yaml
  3. Under spec.containers[0] command/args, add the flag:
    • —bind-address=127.0.0.1
  4. Save the file; the kubelet will automatically restart the Pod with the new setting

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = controllermanager_bind_address. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks