Back to Checks
kubernetes

API server pod has profiling disabled (--profiling=false)

apiserver_disable_profiling
Service: apiserverSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:Pod

Kubernetes API server runtime profiling is controlled by the --profiling flag. The evaluation inspects API server container arguments to confirm --profiling=false and that profiling endpoints (such as /debug/pprof) are not enabled.

Prowler logoProwlerprowler-provider-kubernetes

Risk

With profiling enabled, /debug/pprof exposes stack traces, heap data, and request details that can leak secrets and topology, degrading confidentiality. Heavy profiling queries can exhaust CPU and memory, threatening availability. Insight into code paths and timings can aid exploitation, affecting integrity of the control plane.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks apiserver_disable_profiling

Recommendation

Keep API server profiling disabled by default. If diagnostics are required, enable it briefly in a controlled, isolated environment.

Apply least privilege to debug access, restrict exposure via network controls, and audit usage. Use defense in depth and separation of duties for any profiling enablement.

Remediation

Other

1SSH to the control plane node
2Edit /etc/kubernetes/manifests/kube-apiserver.yaml
3In spec.containers[0].command, add: `--profiling=false`
4Save the file; the kubelet will restart the API server automatically
5Verify the flag is active: `ps aux | grep kube-apiserver | grep -- '--profiling=false'`

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.apiserver.apiserver_client import (
    apiserver_client,
)


class apiserver_disable_profiling(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in apiserver_client.apiserver_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Profiling is disabled in pod {pod.name}."
            profiling_enabled = False
            for container in pod.containers.values():
                profiling_enabled = False
                # Check if "--profiling" is set to false
                if "--profiling=false" not in str(container.command):
                    profiling_enabled = True
                    break
            if profiling_enabled:
                report.status = "FAIL"
                report.status_extended = f"Profiling is enabled in pod {pod.name}."

            findings.append(report)
        return findings

References