Check ID: controllermanager_disable_profiling
Provider: Kubernetes
Service: controllermanager
Severity: MEDIUM
Categories: cluster-security
Resource type: Pod

​
What this check verifies

Kubernetes Controller Manager is evaluated for the --profiling argument. --profiling=false disables runtime profiling; absence or a different value means profiling is enabled.

​
Risk

With profiling enabled, debug endpoints expose runtime internals (stacks, memory, file paths), weakening confidentiality. Abusing profiling can raise CPU/memory use and degrade availability. Detailed insights accelerate reconnaissance and can aid escalation when combined with RBAC gaps.

​
Recommendation

Set --profiling=false on the controller manager to remove debug endpoints. If profiling is needed temporarily:
  • Limit access using least privilege and network controls
  • Use isolated environments and monitor closely
  • Disable promptly to uphold defense in depth

​
Remediation

Dashboard steps
  1. SSH to each control plane node
  2. Open /etc/kubernetes/manifests/kube-controller-manager.yaml
  3. Under spec.containers[0].command add the line: - —profiling=false
  4. Save the file; kubelet will automatically restart the static Pod
  5. Verify on the node: ps -ef | grep kube-controller-manager | grep — —profiling=false

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = controllermanager_disable_profiling. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks