Scheduler pod has --bind-address set to 127.0.0.1

​

What this check verifies

Kubernetes scheduler is configured with --bind-address=127.0.0.1 so its health and metrics endpoints listen only on localhost. The evaluation inspects scheduler pod commands for this bind address.

​

Risk

Exposing scheduler endpoints on non-loopback addresses can:

• leak cluster state and scheduling metrics (confidentiality)
• aid recon that enables privilege escalation (integrity)
• allow health endpoint abuse for DoS (availability)

​

Recommendation

Bind the scheduler to localhost with --bind-address=127.0.0.1 and disable insecure serving (--port=0). Use the secure port with TLS, restrict access via private networks or network policies, and limit metrics exposure. Apply least privilege and defense in depth, and monitor access.

​

Remediation

Dashboard steps

1. SSH to the control plane node
2. Open the static pod manifest: sudo vi /etc/kubernetes/manifests/kube-scheduler.yaml
3. In spec.containers[0].command (or args) for kube-scheduler, add or set this exact flag: —bind-address=127.0.0.1
4. Save the file; the kubelet will automatically restart the scheduler with the new setting

​

References

• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = scheduler_bind_address. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks