feat: Explicitly disable profiling for CP components

[jimmidyson]

As per CIS benchmarks 1.2.15, 1.3.2 and 1.4.1.

Requires #1111.

[Copilot]

Pull Request Overview

This PR explicitly disables profiling for control plane components to comply with CIS benchmarks.

• Added a YAML patch file for KubeadmControlPlaneTemplate to disable profiling.
• Updated Cluster Class YAML files for Nutanix, Docker, and AWS to include profiling disabled in apiServer, controllerManager, and scheduler configurations.

Reviewed Changes

Copilot reviewed 5 out of 8 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
hack/examples/patches/disable-kubeadmcontrolplane-profiling.yaml	Introduces a patch with disabled profiling settings for CP components.
charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/nutanix-cluster-class.yaml	Adds profiling configuration for CP components in the Nutanix cluster class.
charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/nutanix-cluster-class-old.yaml	(No changes related to profiling were introduced, but exists for legacy purposes.)
charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/docker-cluster-class.yaml	Adds profiling disabling for Docker provisioned CP components.
charts/cluster-api-runtime-extensions-nutanix/defaultclusterclasses/aws-cluster-class.yaml	Adds profiling disabling for AWS provisioned CP components.

Files not reviewed (3)

• hack/examples/overlays/clusterclasses/aws/kustomization.yaml.tmpl: Language not supported
• hack/examples/overlays/clusterclasses/docker/kustomization.yaml.tmpl: Language not supported
• hack/examples/overlays/clusterclasses/nutanix/kustomization.yaml.tmpl: Language not supported

Comments suppressed due to low confidence (1)

hack/examples/patches/disable-kubeadmcontrolplane-profiling.yaml:7

• [nitpick] The metadata name 'not-used' is ambiguous and may lead to confusion. Consider renaming it to a more descriptive value, such as 'disable-profiling-template'.

  name: not-used

[dlipovetsky]

I'm not convinced by this change. The CIS 1.2.15 benchmark says "Disable profiling, if not needed." So, is this really required, or just recommended?

I also question the benchmark, for two reasons:

First, the profiling endpoints are "non resource URLs," and access is protected by RBAC. Only the cluster-admin ClusterRole has access to this endpoint by default.

Second, by the time you need profiling, it's too late to enable it (shout out to https://eng.d2iq.com/blog/profiling-kubernetes-controllers-with-pprof/).

A https://raesene.github.io/blog/2024/06/18/Taking-A-Look-At-Kubernetes-Profiling/ on this very topic. My reading of it is that there might be a risk, but there is no evidence of one. Oddly, the blog concludes, without justification, that "in production clusters [profiling] shouldn’t be enabled."

[jimmidyson]

The wording from CIS benchmark is actually Ensure that the --profiling argument is set to false (Scored) which means it is required.

[dlipovetsky]

The wording from CIS benchmark is actually Ensure that the --profiling argument is set to false (Scored) which means it is required.

Ok. I think it's misguided, but I'll take that up with CIS 😎