Back to Checks
kubernetes

Controller Manager pod has --profiling=false configured

controllermanager_disable_profiling
Service: controllermanagerSeverity: medium
OfficialBuilt-inVerified
Categories:cluster-security
Resource Type:Pod

Kubernetes Controller Manager is evaluated for the --profiling argument. --profiling=false disables runtime profiling; absence or a different value means profiling is enabled.

Prowler logoProwlerprowler-provider-kubernetes

Risk

With profiling enabled, debug endpoints expose runtime internals (stacks, memory, file paths), weakening confidentiality. Abusing profiling can raise CPU/memory use and degrade availability. Detailed insights accelerate reconnaissance and can aid escalation when combined with RBAC gaps.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks controllermanager_disable_profiling

Recommendation

Set --profiling=false on the controller manager to remove debug endpoints.

If profiling is needed temporarily:

  • Limit access using least privilege and network controls
  • Use isolated environments and monitor closely
  • Disable promptly to uphold defense in depth

Remediation

Other

1SSH to each control plane node
2Open /etc/kubernetes/manifests/kube-controller-manager.yaml
3Under spec.containers[0].command add the line: - --profiling=false
4Save the file; kubelet will automatically restart the static Pod
5Verify on the node: ps -ef | grep kube-controller-manager | grep -- --profiling=false

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.controllermanager.controllermanager_client import (
    controllermanager_client,
)


class controllermanager_disable_profiling(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in controllermanager_client.controllermanager_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Controller Manager does not have profiling enabled in pod {pod.name}."
            )
            for container in pod.containers.values():
                if "--profiling=false" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = (
                        f"Controller Manager has profiling enabled in pod {pod.name}."
                    )
                    break
            findings.append(report)
        return findings

References