Update service definition to bind to 127.0.0.1 (#9752)
Current service definition will result in an insecure kubelet per the example here: https://medium.com/handy-tech/analysis-of-a-kubernetes-hack-backdooring-through-kubelet-823be5c3d67c This change updates the kubelet configuration to bind to 127.0.0.1 so that the kubelet api does not allow unauthenticated access to the kubelet api.
This commit is contained in:
committed by
k8s-ci-robot
parent
5bcd5df3f3
commit
de9accfca3
@@ -54,7 +54,7 @@ this example.
|
||||
cat << EOF > /etc/systemd/system/kubelet.service.d/20-etcd-service-manager.conf
|
||||
[Service]
|
||||
ExecStart=
|
||||
ExecStart=/usr/bin/kubelet --pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true
|
||||
ExecStart=/usr/bin/kubelet --address=127.0.0.1 --pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true
|
||||
Restart=always
|
||||
EOF
|
||||
|
||||
|
||||
Reference in New Issue
Block a user