kubeadm serves kube-scheduler and kube-controller metrics insecurely

[neolit123]

kubeadm serves kube-scheduler and kube-controller manager metrics insecurely outside of localhost, as reported here:
https://kubernetes.slack.com/archives/C2P1JHS2E/p1593237397449300

i need to double check this myself, but it feels like our --bind-address=127.0.0.1 is not sufficient to disable that.

for example:
curl http://public-ip:10252/metrics

flag refs:
https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/
https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/

[neolit123]

seems related: kubernetes/kubernetes#65869 (comment)

[neolit123]

the KCM docs are lacking some flags:

$ kube-controller-manager --help
...
Insecure serving flags:

      --address ip
                The IP address on which to serve the insecure --port (set to 0.0.0.0 for all IPv4 interfaces and :: for all
                IPv6 interfaces). (default 0.0.0.0) (DEPRECATED: see --bind-address instead.)
      --port int
                The port on which to serve unsecured, unauthenticated access. Set to 0 to disable. (default 10252)
                (DEPRECATED: see --secure-port instead.)

https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/

kubeadm has a couple of options to disable public metrics:

• pass --port=0
• pass --address=127.0.0.1

once these flags are removed, it's not clear how insecure metrics will be possible.

[neolit123]

xref kubernetes/kubernetes#91506

[neolit123]

we discussed that --port=0 might be a good option by default and the users can still override using "extraArgs".

PRs for master (1.19) and branches in the support skew:
kubernetes/kubernetes#92720
kubernetes/kubernetes#92723
kubernetes/kubernetes#92725
kubernetes/kubernetes#92726