Profiling Not Set To False

• Query id: 2f491173-6375-4a84-b28e-a4e2b9a58a69
• Query name: Profiling Not Set To False
• Platform: Kubernetes
• Severity: Low
• Category: Observability
• URL: Github

Description

When using kube-apiserver or kube-controller-manager or kube-scheduler command, the '--profiling' flag should be defined and set to false
Documentation

Code samples

Code samples with security vulnerabilities

Positive test num. 1 - yaml file

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
      command: ["kube-apiserver"]
      args: ["--profiling=true"]
  restartPolicy: OnFailure

Positive test num. 2 - yaml file

apiVersion: v1
kind: Pod
metadata:
  name: command-demo-1
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
      command: ["kube-apiserver"]
      args: []
  restartPolicy: OnFailure

Positive test num. 3 - yaml file

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-controller-manager
    tier: control-plane
  name: kube-controller-manager-master-3
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: kube-controller-manager
  template:
    metadata:
      labels:
        app: kube-controller-manager
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-master-3
      command: ["kube-controller-manager","--profiling=true"]
      args: []
  restartPolicy: OnFailure

Positive test num. 4 - yaml file

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-controller-manager
    tier: control-plane
  name: kube-controller-manager-master-4
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: kube-controller-manager
  template:
    metadata:
      labels:
        app: kube-controller-manager
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-master-4
      command: ["kube-controller-manager"]
      args: []
  restartPolicy: OnFailure

Positive test num. 5 - yaml file

apiVersion: kubescheduler.config.k8s.io/v1beta2
kind: KubeSchedulerConfiguration
profiles:
  pluginConfig:
    args:
      scoringStrategy:
        resources:
          name: cpu
          weight: 1
        type: MostAllocated
    name: NodeResourcesFit

Positive test num. 6 - yaml file

apiVersion: kubescheduler.config.k8s.io/v1beta2
kind: KubeSchedulerConfiguration
enableProfiling: true
profiles: 
  pluginConfig: 
    args: 
      scoringStrategy: 
        resources:  
          name: cpu
          weight: 1
        type: MostAllocated
    name: NodeResourcesFit2

Positive test num. 7 - yaml file

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-scheduler
    tier: control-plane
  name: kube-scheduler-master-2
  namespace: kube-system
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-scheduler-master-2
      command: ["kube-scheduler","--profiling=true"]
      args: []
  restartPolicy: OnFailure

Code samples without security vulnerabilities

Negative test num. 1 - yaml file

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0
      command: ["kube-apiserver"]
      args: ["--profiling=false"]
  restartPolicy: OnFailure

Negative test num. 2 - yaml file

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-controller-manager
    tier: control-plane
  name: kube-controller-manager-master-1
  namespace: kube-system
spec:
  selector:
    matchLabels:
      app: kube-controller-manager
  template:
    metadata:
      labels:
        app: kube-controller-manager
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-master-1
      command: ["kube-controller-manager","--profiling=false"]
      args: []
  restartPolicy: OnFailure

Negative test num. 3 - yaml file

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-scheduler
    tier: control-plane
  name: kube-scheduler-master-3
  namespace: kube-system
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-scheduler-master-1
      command: ["kube-scheduler","--profiling=false"]
      args: []
  restartPolicy: OnFailure

Negative test num. 4 - yaml file

apiVersion: kubescheduler.config.k8s.io/v1beta2
kind: KubeSchedulerConfiguration
enableProfiling: false
profiles:
- pluginConfig:
  - args:
      scoringStrategy:
        resources:
        - name: cpu
          weight: 1
        type: MostAllocated
    name: NodeResourcesFit3

Negative test num. 5 - yaml file

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    component: kube-scheduler
    tier: control-plane
  name: kube-scheduler-master-1
  namespace: kube-system
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-scheduler-master-1
      command: ["kube-scheduler"]
      args: []
  restartPolicy: OnFailure