Kubernetes

Kubernetes Scheduler

Overview

John W8MEJ Menerick July 23, 2019 1-minute read Updated August 18, 2026

Key takeaways

The Kubelet API endpoint must require strong authentication; unauthenticated access grants remote code execution.
Pod affinity and taint configurations prevent sensitive workloads from co-locating with untrusted containers.
Scheduler policies should enforce security isolation boundaries across heterogeneous nodes.

Overview

This is the building block that handles pods scheduling based upon resource constraints, requirements, tolerances, governance, and other policies. The scheduler’s pod spec and kubeconfig file permissions should be restricted and only accessible over HTTPS. Please bind to localhost because it exposes sensitive metrics and health data that doesn’t require authentication by default.

CIS Benchmark

1.4.1 Ensure that the –profiling argument is set to false (Automated)

1.4.2 Ensure that the –bind-address argument is set to 127.0.0.1 (Automated)

About the author

John W8MEJ Menerick

Explore cutting-edge cybersecurity insights and protective strategies with John Menerick. Deep dives, threat analysis, and live streams from securesql.info.

Research Speaking About

Overview

CIS Benchmark

Related reading

Autonomous Incident Response at Scale: How Energy-Based Models & TAME Replace LLM Guessing in Security

Security Theater and Cap Tables: Deconstructing Cal.com's Closed-Source Pivot

Episode 2: The Layer 2 Bridge Lab