Securing kube-scheduler


 Please execute this command at master node, to see the values of configuration parameters / flags for K8s Scheduler

ps -ef | grep kube-scheduler

As per section 1.4 of CIS Benchmark

* --profiling should be change from default true to false

* --bind-address should be change from 0.0.0.0 to 127.0.0.1 

Additional tips not in CIS Benchmark

* Ensure that AppArmor is not disabled for kube-scheduler.

* AllowExtTrafficLocalEndpoints feature is disabled using --feature-gates

0 comments:

Post a Comment