Securing kube-scheduler
Please execute this command at master node, to see the values of configuration parameters / flags for K8s Scheduler
ps -ef | grep kube-scheduler
As per section 1.4 of CIS Benchmark
* --profiling should be change from default true to false
* --bind-address should be change from 0.0.0.0 to 127.0.0.1
Additional tips not in CIS Benchmark
* Ensure that AppArmor is not disabled for kube-scheduler.
* AllowExtTrafficLocalEndpoints feature is disabled using --feature-gates
0 comments:
Post a Comment