{"record":{"id":"17d299d0e95de8e6","repo":"kubernetes/kubernetes","slug":"profiling-endpoint-is-disabled","errorCode":null,"errorMessage":"profiling endpoint is disabled.","messagePattern":"profiling endpoint is disabled\\.","errorType":"http","errorClass":null,"httpStatus":405,"severity":"warning","filePath":"pkg/kubelet/server/server.go","lineNumber":764,"sourceCode":"\t\t\t\tTo(s.getLogs).\n\t\t\t\tOperation(\"getLogs\").\n\t\t\t\tParam(ws.PathParameter(\"logpath\", \"path to the log\").DataType(\"string\")).\n\t\t\t\tParam(ws.QueryParameter(\"query\", \"query specifies services(s) or files from which to return logs\").DataType(\"string\")).\n\t\t\t\tParam(ws.QueryParameter(\"sinceTime\", \"sinceTime is an RFC3339 timestamp from which to show logs\").DataType(\"string\")).\n\t\t\t\tParam(ws.QueryParameter(\"untilTime\", \"untilTime is an RFC3339 timestamp until which to show logs\").DataType(\"string\")).\n\t\t\t\tParam(ws.QueryParameter(\"tailLines\", \"tailLines is used to retrieve the specified number of lines from the end of the log\").DataType(\"string\")).\n\t\t\t\tParam(ws.QueryParameter(\"pattern\", \"pattern filters log entries by the provided regex pattern\").DataType(\"string\")).\n\t\t\t\tParam(ws.QueryParameter(\"boot\", \"boot show messages from a specific system boot\").DataType(\"string\")))\n\t\t}\n\t\ts.restfulCont.Add(ws)\n\t} else {\n\t\ts.restfulCont.Handle(logsPath, getHandlerForDisabledEndpoint(\"logs endpoint is disabled.\"))\n\t}\n}\n\nfunc getHandlerForDisabledEndpoint(errorMessage string) http.HandlerFunc {\n\treturn http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {\n\t\thttp.Error(w, errorMessage, http.StatusMethodNotAllowed)\n\t})\n}\n\n// InstallDebugFlagsHandler registers the HTTP request patterns for /debug/flags/v endpoint.\nfunc (s *Server) InstallDebugFlagsHandler(enableDebugFlagsHandler bool) {\n\tif enableDebugFlagsHandler {\n\t\t// Setup flags handlers.\n\t\t// so far, only logging related endpoints are considered valid to add for these debug flags.\n\t\ts.restfulCont.Handle(debugFlagPath, routes.StringFlagPutHandler(logs.GlogSetter))\n\t} else {\n\t\ts.restfulCont.Handle(debugFlagPath, getHandlerForDisabledEndpoint(\"flags endpoint is disabled.\"))\n\t\treturn\n\t}\n}\n\n// InstallProfilingHandler registers the HTTP request patterns for /debug/pprof endpoint.\nfunc (s *Server) InstallProfilingHandler(enableProfilingLogHandler bool, enableContentionProfiling bool) {\n\ts.addMetricsBucketMatcher(\"debug\")","sourceCodeStart":746,"sourceCodeEnd":782,"githubUrl":"https://github.com/kubernetes/kubernetes/blob/b882c60b4023bdf09264c2d5d30a2cadebc240fb/pkg/kubelet/server/server.go#L746-L782","documentation":"InstallProfilingHandler (server.go:784) calls getHandlerForDisabledEndpoint('profiling endpoint is disabled.') when enableProfilingLogHandler is false, returning HTTP 405 (server.go:764) for the pprof base path.","triggerScenarios":"Request to the kubelet /debug/pprof endpoint when profiling is disabled (EnableProfiling false).","commonSituations":"Hardened kubelet started with profiling off; an operator or monitoring tool trying to capture a CPU/heap profile via pprof.","solutions":["Restart kubelet with profiling enabled (--profiling=true) if capturing profiles is required","Note contention profiling additionally needs enableContentionProfiling true","Otherwise treat the 405 as expected hardening"],"exampleFix":"// before: --profiling=false; GET /debug/pprof/ -> 405\n// after:  --profiling=true (restart kubelet) -> pprof index served","handlingStrategy":"validation","validationCode":"if !enableProfiling {\n    // capture profiles from a node where profiling is enabled, or via a one-off debug pod\n    return fmt.Errorf(\"kubelet profiling disabled; enable --profiling on a debug node to capture pprof\")\n}","typeGuard":"func profilingEndpointDisabled(resp *http.Response) bool {\n    return resp.StatusCode == http.StatusMethodNotAllowed && strings.Contains(readBody(resp), \"profiling endpoint is disabled\")\n}","tryCatchPattern":null,"preventionTips":["Keep profiling off in production; enable on a dedicated debug node when needed","For contention profiles also set enableContentionProfiling=true","Capture profiles through a short-lived privileged debug pod instead of the kubelet endpoint"],"tags":["kubelet","pprof","profiling","http","hardening","method-not-allowed"],"analyzedSha":"b882c60b4023bdf09264c2d5d30a2cadebc240fb","analyzedAt":"2026-08-07T04:07:48.144Z","schemaVersion":2},"datasetVersion":"2026-08-07T07:17:06.508Z"}