Fix the kube-bench 1.4.1 to enhance security

[yankay]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Fix kube-bench check Fail 1.4.1 by disable the profiling.
Ref to https://github.com/aquasecurity/kube-bench/blob/main/cfg/cis-1.24/master.yaml#L919

Which issue(s) this PR fixes:

Fixes #9933

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Fix kube-bench 1.4.1 to enhance security (Ensure that the --profiling argument is set to false (Automated))

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: yankay

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [yankay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mzaian]

Hi @yankay

I think the default is false anyway so maybe no need to configure it.

[oomichi]

as #9986 (comment) this additional configuration also is written on https://github.com/kubernetes-sigs/kubespray/blob/master/docs/hardening.md
I feel it is fine to have that is a separeted configuration as is.

/hold

[yankay]

Hi @yankay

I think the default is false anyway so maybe no need to configure it.

HI @mzaian

I checked the default value the profile, and it's true.

[root@kay181 kubernetes]# nerdctl exec -it 7570a7b4a38d kube-scheduler --help
...
--profiling                                         DEPRECATED: enable profiling via web interface host:port/debug/pprof/. This parameter is ignored if a config file is specified in --config. (default true)

[mzaian]

@yankay Worth mentioning that we discussed it here as well #9824

[yankay]

@yankay Worth mentioning that we discussed it here as well #9824
HI @mzaian

I got it, it kube-profile is only worked on the api-server and ccm, but not the scheduler
https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes/control-plane/templates/kubeadm-config.v1beta3.yaml.j2