From de9accfca3e7cf9a7c3f9b625379b627bd464dd5 Mon Sep 17 00:00:00 2001 From: Duffie Cooley Date: Fri, 3 Aug 2018 16:56:27 -0700 Subject: [PATCH] Update service definition to bind to 127.0.0.1 (#9752) Current service definition will result in an insecure kubelet per the example here: https://medium.com/handy-tech/analysis-of-a-kubernetes-hack-backdooring-through-kubelet-823be5c3d67c This change updates the kubelet configuration to bind to 127.0.0.1 so that the kubelet api does not allow unauthenticated access to the kubelet api. --- content/en/docs/setup/independent/setup-ha-etcd-with-kubeadm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/setup/independent/setup-ha-etcd-with-kubeadm.md b/content/en/docs/setup/independent/setup-ha-etcd-with-kubeadm.md index 65a2897233..bd8bae5f06 100644 --- a/content/en/docs/setup/independent/setup-ha-etcd-with-kubeadm.md +++ b/content/en/docs/setup/independent/setup-ha-etcd-with-kubeadm.md @@ -54,7 +54,7 @@ this example. cat << EOF > /etc/systemd/system/kubelet.service.d/20-etcd-service-manager.conf [Service] ExecStart= - ExecStart=/usr/bin/kubelet --pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true + ExecStart=/usr/bin/kubelet --address=127.0.0.1 --pod-manifest-path=/etc/kubernetes/manifests --allow-privileged=true Restart=always EOF