Back to Checks
kubernetes

Controller Manager pod is bound to the loopback address 127.0.0.1

controllermanager_bind_address
Service: controllermanagerSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityinternet-exposed
Resource Type:Pod

Kubernetes controller manager uses the loopback bind address 127.0.0.1 via --bind-address or --address, keeping its health, metrics, and debug endpoints reachable only from the host

Prowler logoProwlerprowler-provider-kubernetes

Risk

Listening on a non-loopback address exposes health, metrics, and debug endpoints to the network, enabling control-plane reconnaissance and leakage of internal state. Heavy scraping or profiling can drive resource exhaustion, reducing control-plane availability and stability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks controllermanager_bind_address

Recommendation

Bind to 127.0.0.1 and apply defense in depth:

  • Prefer local-only endpoints; avoid 0.0.0.0
  • Use TLS and authentication if exposure is unavoidable
  • Enforce network segmentation for control-plane access
  • Disable profiling when not needed; apply least privilege for telemetry

Remediation

Other

1SSH to the control-plane node running the Controller Manager
2Edit the static Pod manifest: /etc/kubernetes/manifests/kube-controller-manager.yaml
3Under spec.containers[0] command/args, add the flag:
4- --bind-address=127.0.0.1
5Save the file; the kubelet will automatically restart the Pod with the new setting

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
    controllermanager_client,
)


class controllermanager_bind_address(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in controllermanager_client.controllermanager_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = f"Controller Manager is bound to the loopback address in pod {pod.name}."
            for container in pod.containers.values():
                if "--bind-address=127.0.0.1" not in str(
                    container.command
                ) and "--address=127.0.0.1" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"Controller Manager is not bound to the loopback address in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References