how to disable debug interface of pilot-agent

[zgyn76]

Bug Description

For istiod, i can set env var "ENABLE_DEBUG_ON_HTTP" to "true" to enable debug interface.
why isn't there a similar env var for pilot-agent?

Version

istio control-plane 1.13.8
istio data-plane 1.13.8

Additional Information

No response

[zirain]

should we provide option to disable debug interface on pilot-agent
@istio/wg-security-maintainers WDYT?

[howardjohn]

Why?

[zgyn76]

Why?

For security concerns.
I've noticed that it is recommended to set the parameter ENABLE_DEBUG_ON_HTTP to false for production. Maybe this is for security(?).
Some debug interfaces of pilot-agent are consistent with those of istiod, such as pprof. So, is it necessary to disable the debug interface of pilot-agent for production?

[istio-policy-bot]

🚧 This issue or pull request has been closed due to not having had activity from an Istio team member since 2022-10-17. If you feel this issue or pull request deserves attention, please reopen the issue. Please see this wiki page for more information. Thank you for your contributions.

Created by the issue and PR lifecycle manager.