kubernetes/kubernetes · warning

profiling endpoint is disabled.

Error message

profiling endpoint is disabled.

What it means

InstallProfilingHandler (server.go:784) calls getHandlerForDisabledEndpoint('profiling endpoint is disabled.') when enableProfilingLogHandler is false, returning HTTP 405 (server.go:764) for the pprof base path.

Source

Thrown at pkg/kubelet/server/server.go:764

				To(s.getLogs).
				Operation("getLogs").
				Param(ws.PathParameter("logpath", "path to the log").DataType("string")).
				Param(ws.QueryParameter("query", "query specifies services(s) or files from which to return logs").DataType("string")).
				Param(ws.QueryParameter("sinceTime", "sinceTime is an RFC3339 timestamp from which to show logs").DataType("string")).
				Param(ws.QueryParameter("untilTime", "untilTime is an RFC3339 timestamp until which to show logs").DataType("string")).
				Param(ws.QueryParameter("tailLines", "tailLines is used to retrieve the specified number of lines from the end of the log").DataType("string")).
				Param(ws.QueryParameter("pattern", "pattern filters log entries by the provided regex pattern").DataType("string")).
				Param(ws.QueryParameter("boot", "boot show messages from a specific system boot").DataType("string")))
		}
		s.restfulCont.Add(ws)
	} else {
		s.restfulCont.Handle(logsPath, getHandlerForDisabledEndpoint("logs endpoint is disabled."))
	}
}

func getHandlerForDisabledEndpoint(errorMessage string) http.HandlerFunc {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		http.Error(w, errorMessage, http.StatusMethodNotAllowed)
	})
}

// InstallDebugFlagsHandler registers the HTTP request patterns for /debug/flags/v endpoint.
func (s *Server) InstallDebugFlagsHandler(enableDebugFlagsHandler bool) {
	if enableDebugFlagsHandler {
		// Setup flags handlers.
		// so far, only logging related endpoints are considered valid to add for these debug flags.
		s.restfulCont.Handle(debugFlagPath, routes.StringFlagPutHandler(logs.GlogSetter))
	} else {
		s.restfulCont.Handle(debugFlagPath, getHandlerForDisabledEndpoint("flags endpoint is disabled."))
		return
	}
}

// InstallProfilingHandler registers the HTTP request patterns for /debug/pprof endpoint.
func (s *Server) InstallProfilingHandler(enableProfilingLogHandler bool, enableContentionProfiling bool) {
	s.addMetricsBucketMatcher("debug")

View on GitHub (pinned to b882c60b40)

Solutions

1. Restart kubelet with profiling enabled (--profiling=true) if capturing profiles is required
2. Note contention profiling additionally needs enableContentionProfiling true
3. Otherwise treat the 405 as expected hardening

Example fix

// before: --profiling=false; GET /debug/pprof/ -> 405
// after:  --profiling=true (restart kubelet) -> pprof index served

if !enableProfiling {
    // capture profiles from a node where profiling is enabled, or via a one-off debug pod
    return fmt.Errorf("kubelet profiling disabled; enable --profiling on a debug node to capture pprof")
}

func profilingEndpointDisabled(resp *http.Response) bool {
    return resp.StatusCode == http.StatusMethodNotAllowed && strings.Contains(readBody(resp), "profiling endpoint is disabled")
}

When it happens

Trigger: Request to the kubelet /debug/pprof endpoint when profiling is disabled (EnableProfiling false).

Common situations: Hardened kubelet started with profiling off; an operator or monitoring tool trying to capture a CPU/heap profile via pprof.

Related errors

• Debug endpoints are disabled.
• logs endpoint is disabled.
• flags endpoint is disabled.
• Method not allowed
• path not allowed in query mode

AI-assisted analysis of kubernetes/kubernetes@b882c60b40 (2026-08-07). Data as JSON: /api/errors/17d299d0e95de8e6. Report an issue: GitHub.