Disable pprof endpoints by default

[yboaron]

The pprof debugging endpoints were unconditionally exposed on all Submariner components running with hostNetwork: true, making them accessible on all host network interfaces without authentication.

Make pprof endpoints conditional on SUBMARINER_DEBUG environment variable (disabled by default) for all components.

Summary by CodeRabbit

• New Features
  • Added a debug configuration toggle to control whether profiling endpoints are exposed, enabled only in debug mode (disabled by default).
  • When debug mode is enabled, profiling endpoints start and a warning is logged including the relevant metrics port.
  • Metrics endpoints remain enabled at all times for monitoring.

[submariner-bot]

🤖 Created branch: z_pr4070/yboaron/security-fix-pprof-disable-by-default
🚀 Full E2E won't run until the "ready-to-test" label is applied. I will add it automatically once the PR has 2 approvals, or you can add it manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e71c5fe6-b508-4835-a5eb-e0150ba10225

📥 Commits

Reviewing files that changed from the base of the PR and between 5b26ad6 and 95500a9.

📒 Files selected for processing (5)

• main.go
• pkg/globalnet/controllers/types.go
• pkg/globalnet/main.go
• pkg/routeagent_driver/environment/env.go
• pkg/routeagent_driver/main.go

🚧 Files skipped from review as they are similar to previous changes (5)

• pkg/globalnet/main.go
• pkg/routeagent_driver/environment/env.go
• pkg/routeagent_driver/main.go
• main.go
• pkg/globalnet/controllers/types.go

---

Walkthrough

Three components — submariner main, globalnet, and routeagent_driver — add a Debug bool field (defaulting to false) to their configuration structs and update their HTTP server startup to conditionally include profiling endpoints only when Debug is true, logging a security warning when profiling is active.

Changes

Conditional HTTP Profiling Gate

Layer / File(s)	Summary
Debug field added to Specification structs pkg/globalnet/controllers/types.go, pkg/routeagent_driver/environment/env.go	Both Specification structs gain a Debug bool field with default:"false", providing the configuration toggle consumed by the startup logic.
Conditional profiling startup in all three mains main.go, pkg/globalnet/main.go, pkg/routeagent_driver/main.go	Each main now initializes endpoints to http.Metrics, ORs in http.Profile only when the respective Debug flag is true (emitting a warning log with the port), and defers http.StartServer with the computed endpoint set. Non-debug mode logs that profiling is disabled.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• skitt
• vthapar
• sridhargaddam
• tpantelis
• Oats87

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title 'Disable pprof endpoints by default' directly and clearly summarizes the main security-focused change across all modified files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Actionable Comments Resolved	✅ Passed	No actionable comments found in code or from reviewers. PR shows no TODO/FIXME markers and PR description confirms no substantive review comments posted yet.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[submariner-bot]

🤖 Closed branches: [z_pr4070/yboaron/security-fix-pprof-disable-by-default]