Back to Checks
kubernetes

Scheduler pod has --bind-address set to 127.0.0.1

scheduler_bind_address
Service: schedulerSeverity: high
OfficialBuilt-inVerified
Categories:cluster-securityinternet-exposed
Resource Type:Pod

Kubernetes scheduler is configured with --bind-address=127.0.0.1 so its health and metrics endpoints listen only on localhost.

The evaluation inspects scheduler pod commands for this bind address.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Exposing scheduler endpoints on non-loopback addresses can:

  • leak cluster state and scheduling metrics (confidentiality)
  • aid recon that enables privilege escalation (integrity)
  • allow health endpoint abuse for DoS (availability)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks scheduler_bind_address

Recommendation

Bind the scheduler to localhost with --bind-address=127.0.0.1 and disable insecure serving (--port=0). Use the secure port with TLS, restrict access via private networks or network policies, and limit metrics exposure. Apply least privilege and defense in depth, and monitor access.

Remediation

Other

1SSH to the control plane node
2Open the static pod manifest: sudo vi /etc/kubernetes/manifests/kube-scheduler.yaml
3In spec.containers[0].command (or args) for kube-scheduler, add or set this exact flag: --bind-address=127.0.0.1
4Save the file; the kubelet will automatically restart the scheduler with the new setting

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.scheduler.scheduler_client import (
    scheduler_client,
)


class scheduler_bind_address(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in scheduler_client.scheduler_pods:
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Scheduler is bound to the loopback address in pod {pod.name}."
            )
            for container in pod.containers.values():
                if "--bind-address=127.0.0.1" not in str(container.command):
                    report.status = "FAIL"
                    report.status_extended = f"Scheduler is not bound to the loopback address in pod {pod.name}."
                    break
            findings.append(report)
        return findings

References