Scheduler pod has profiling disabled

​

What this check verifies

Kubernetes Scheduler profiling configuration, specifically whether scheduler containers run with --profiling=false to keep the profiling API disabled.

​

Risk

With profiling enabled, the pprof endpoints can expose runtime internals (stack traces, memory, goroutines), aiding reconnaissance and credential discovery, harming confidentiality. Extra CPU/heap usage can be abused for DoS, impacting availability.

​

Recommendation

Disable by default: set --profiling=false on the Scheduler. If profiling is required, enable it only temporarily, restrict access with network policies, bind to loopback, and log/monitor usage. Apply least privilege and defense in depth to limit exposure.

​

Remediation

Dashboard steps

1. SSH to the control-plane node
2. Edit the scheduler manifest: sudo vi /etc/kubernetes/manifests/kube-scheduler.yaml
3. In spec.containers[].command, add this flag (or change existing to false):
   --profiling=false
   
4. Save the file; kubelet will automatically restart the scheduler with profiling disabled

​

References

• https://kubernetes.io/docs/admin/kube-scheduler/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = scheduler_profiling. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks