Listen insecurely on localhost only

Before this change, k3s configured the scheduler and controller's insecure ports to listen on 0.0.0.0. Those ports include pprof, which provides a DoS vector at the very least. These ports are only enabled for componentstatus checks in the first place, and componentstatus is hardcoded to only do the check on localhost anyway (see https://github.com/kubernetes/kubernetes/blob/v1.18.2/pkg/registry/core/rest/storage_core.go#L341-L344), so there shouldn't be any downside to switching them to listen only on localhost.

Listen insecurely on localhost only
4808c4e7 · Euan Kemp · Brad Davidson · c8282f49 · 4808c4e7
Commit 4808c4e7 authored Apr 28, 2020 by Euan Kemp Committed by Brad Davidson Aug 05, 2020
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

server.go pkg/daemons/control/server.go +2 -0

No files found.
--- a/pkg/daemons/control/server.go
+++ b/pkg/daemons/control/server.go
@@ -131,6 +131,7 @@ func controllerManager(cfg *config.Control, runtime *config.ControlRuntime) erro
 		"root-ca-file":                     runtime.ServerCA,
 		"port":                             "10252",
 		"profiling":                        "false",
+		"address":                          localhostIP.String(),
 		"bind-address":                     localhostIP.String(),
 		"secure-port":                      "0",
 		"use-service-account-credentials":  "true",
@@ -151,6 +152,7 @@ func scheduler(cfg *config.Control, runtime *config.ControlRuntime) error {
 	argsMap := map[string]string{
 		"kubeconfig":   runtime.KubeConfigScheduler,
 		"port":         "10251",
+		"address":      "127.0.0.1",
 		"bind-address": "127.0.0.1",
 		"secure-port":  "0",
 		"profiling":    "false",